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Earlier this month, the United Nations monitoring team that tracks the 
global jihadi threat warned the Security Council that “ISIL franchises in 

West Africa and the Sahel continued to enjoy operational success in early 
2020, as have those of Al-Qaida, heightening international concern about stability in the region.” 
Concern over the threat has grown despite the fact that a year ago clashes erupted between the Islam- 
ic State and al-Qa ‘ida franchises in the region, turning what had been an often amicable and some- 
times cooperative relationship into fighting between them in Mali and Burkina Faso. 

In our feature article, Héni Nsaibia and Caleb Weiss assess that a number of factors ended the “Sa- 
helian anomaly” of amicable relations between the regional Islamic State and al-Qa ‘ida groupings, 
“including the hardening of ideological divisions, pressure from Islamic State Central for its regional 
satellite to take on a more confrontational approach toward its rival, and tensions created by the 
growing ambition of the Islamic State affiliate in the Sahel.” They note that “while some argue that 
fighting between jihadi groups is positive for the counterterrorism landscape, it is also possible that 
the two groups are in effect engaging in a process called ‘outbidding, wherein a group aims to show 
‘greater resolve to fight the enemy than rival groups.” 

Our interview is with Chris Costa, who during the first year of the Trump administration served as 
the Special Assistant to the President and Senior Director for Counterterrorism. 

Building on a study of terrorist recidivism in Belgium by Thomas Renard published in the April 
issue of CTC Sentinel, Robin Simcox and Hannah Stuart examine the problem set created by jihadi 
prisoners in Europe from two different angles. Firstly, they examine the nature of the threat by an- 
alyzing a dozen alleged jihadi terror plots and attacks that occurred inside and outside prisons in 
Western Europe since 2014 in which at least one of the attackers/plotters had been convicted in 
Europe of a previous terrorism offense. Secondly, they look at the scale of the threat by calculating 
the rates of various forms of recidivism from a comprehensive database relating to U.K. jihadi terror 
activity. 

Amarnath Amarasingam and Marc-André Argentino assess the emerging security threat posed by 
the QAnon conspiracy. They write: “A survey of cases of individuals who have allegedly or apparently 
been radicalized to criminal acts with a nexus to violence by QAnon, including one case that saw a 
guilty plea on a terrorism charge, makes clear that QAnon represents a public security threat with 
the potential in the future to become a more impactful domestic terror threat. This is true especially 
given that conspiracy theories have a track record of propelling terrorist violence elsewhere in the 
West as well as QAnon’s more recent influence on mainstream political discourse.” 

Paul Cruickshank, Editor in Chief 
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The End of the Sahelian Anomaly: How the Global 
Conflict between the Islamic State and al-Qa ‘ida 
Finally Came to West Africa 


By Héni Nsaibia and Caleb Weiss 


After the emergence of the Islamic State in the Sahel (or 
the Islamic State in the Greater Sahara) in 2015, the group 
existed in an uneasy alliance with al-Qa ‘ida’s various 
franchises in the region. Proving to be an exception to the 
rule that al-Qa ‘ida and the Islamic State fight each other 
in whichever territory they co-inhabit, the Sahel was for 
several years spared from such jihadi-on-jihadi fighting, 
in part because of personal relationships between jihadis 
in the rival groups. However, in recent months, this trend 
has been bucked by fighting between the two jihadi forces 
in Mali and Burkina Faso. As the two forces expand in the 
Sahel, a number of factors explain the growing tensions 
between the two sides, including the hardening of ideologi- 
cal divisions, pressure from Islamic State Central for its re- 
gional satellite to take on a more confrontational approach 
toward its rival, and tensions created by the growing ambi- 
tion of the Islamic State affiliate in the Sahel. 


ersistent violence has raged on for more than eight 

years in the Sahel, where al-Qa ‘ida’s Jama’at Nusrat 

al-Islam wal-Muslimin (JNIM) and the Islamic State 

in the Greater Sahara (ISGS) are driving sub-regional 

insurgencies in Mali, Burkina Faso, and Niger. After the 

emergence of ISGS in 2015, the two rival jihadi franchises for sev- 

eral years existed within an uneasy alliance in the region. This rela- 

tionship was often described as the “Sahelian exception,” drawing 

attention to the lack of conflict between the two amid intra-jihadi 

fighting between al-Qa ‘ida and Islamic State affiliates in other con- 
flict theaters around the world. 

For instance, internecine battles between the Taliban and the 

Islamic State Khorasan Province in Afghanistan,” al-Qa ‘ida in the 

Arabian Peninsula and the Islamic State in Yemen,’ al-Shabaab 
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in the Middle East and Africa, and a Master of Arts in Law and 
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The authors thank Jules Duhamel, who created the map featured 
in this article. Follow @julesdhl 


and the Islamic State in Somalia,* and Hayat Tahrir al-Sham and 
the Islamic State in Syria’ have all transpired since the inception 
of the Islamic State. Despite this precedent, JNIM and ISGS were 
reported as still cooperating in the region by the United Nations as 
recently as February 2020.° 

While it is true that ISGS had intermittent issues with the various 
al-Qa ‘ida franchises in the Sahel in the years after its emergence, 
these issues had historically always stopped short of outright vio- 
lence, with the sides able to deconflict before disagreements came 
to blows. This so-called ‘exceptionalism, however, appears to have 
recently run its course. Beginning last year, tensions and violent 
clashes between the two sides have been reported in several areas of 
northern and central Mali, and northern and eastern Burkina Faso.’ 

The recent fighting between JNIM and ISGS, which since March 
2019 has formally operated as a subgroup with the Islamic State’s 
West Africa Province,* has sparked debate among observers and 
analysts about the nature of the relationship between the two. Some 
argue that these groups have historically been two clearly distinct 
entities with no cooperation between them,’ or at best opportunistic 
or circumstantial cooperation, while others state that they regularly 
coordinate and conduct operations to jointly control territory.’ Pro- 
ponents of the former argument tend to contend that the historical 
lack of violence is explained by indifference and that clashes were 
inevitable,’? while proponents of the latter argument tend to find 
that the lack of perceived violence is indicative of outright amity 
and cooperation.” 

This article seeks to offer a nuanced perspective of the JNIM 
and ISGS relationship. The authors find that while there was never 
a “grand alliance” between JNIM and ISGS, the two groups benefit- 
ed from cooperation on the ground owing to their shared histories 
and the personal relationships that transcended the global jihadi 
rivalry. Over time, however, significant local tension between the 
jihadi franchises developed, which undercut the previously built-up 
goodwill and led to violent clashes between them across the Sahel. 

The first part of the article examines the special relationship that 
was forged between ISGS and JNIM. In looking at the “Sahelian” 
anomaly, it examines the common origins of both ISGS and JNIM, 
before assessing what the authors identify as the two key drivers 


a Itis important to note that the name ISGS is unofficial. Since March 2019, 
the group has operated under the Islamic State’s West Africa Province 
(ISWAP) moniker, formally operating as a subgroup within that entity. 
However, the leadership hierarchy between Islamic State commanders 
in Nigeria, where ISWAP is headquartered, and ISGS commanders in the 
Sahel is currently unknown. The United Nations has found that although 
ISGS and ISWAP “have joint facilitators,” ISGS is currently “operationally 
independent” from ISWAP. The usage of “ISGS” in this article is based 
on familiarity and for easier understanding. See “Twenty-fifth report of 
the Analytical Support and Sanctions Monitoring Team concerning ISIL 
(Da’esh), Al-Qaida and associated individuals and entities,” United Nations, 
December 27, 2019, p. 11. 
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and manifestations of the previous special relationship between the 
groups in the Sahel: amicable personal relationships and coordinat- 
ed actions in the Sahel. The second part of the article looks at how 
the groups have descended into open warfare since the summer 
of 2019. It provides a timeline of clashes between the entities and 
then identifies and examines a number of drivers of tension and 
conflict between the groups, which help to explain why the special 
relationship collapsed. The article concludes by discussing the fu- 
ture outlook for the conflict and the implications of the intra-jihadi 
clashes for the Sahel writ large. 


Part One: The Forging of a Special Relationship 


The Common Origins of ISGS and JNIM 

In discussing the relationship between JNIM and ISGS, it is im- 
portant to briefly describe the common origins of both entities. This 
history provides important context that helps explain why the two 
organizations continued to cooperate, even after one set of jihadis 
left al-Qa ‘ida’s fold. In this respect, ISGS can be traced back to the 
former Movement for Oneness and Jihad in West Africa (MUJAO), 
a splinter group that left al-Qa ‘ida in the Islamic Maghreb (AQIM) 
in 2011.” 

Originally founded by Sultan Ould Bady, Ahmed al Tilem- 
si, Hamada Ould al-Kheiry (or Kheirou), and Adnan Abu Walid 
al-Sahraoui,” MUJAO continued to work with AQIM and oth- 
er al-Qa ‘ida franchises in the region, especially during the 2012 
takeover of northern Mali.* During al-Qa ‘ida’s control of north- 
ern Mali, many of MUJAO’s leaders became influential in Gao, 
including al-Sahraoui, who subsequently became the leader of 
the proclaimed ‘Mujahideen Shura Council of the Islamic Emir- 
ate of Gao.”® Following the French-led intervention that removed 
al-Qa ‘ida from its northern Mali territory in January 2013, much 
of MUJAO merged with another al-Qa ‘ida group in the region, 
Al-Mulathimin (or the Al-Muwagqqioon Bid-Dima Brigade) led by 
Mokhtar Belmokhtar, to form Al-Mourabitoun and pledged alle- 
giance directly to al-Qa ‘ida’s overall leader, Ayman al-Zawahiri.’ 

Both Tilemsi and Belmokhtar, however, would step aside to al- 
low Egyptian fighter Abu Bakr al-Masri to command Al-Mourabi- 
toun.° Following al-Masri’s death in April 2014, Tilemsi, a Malian 
Arab, would then take over until his death in December 2014.” It 
was after Tilemsi’s death and the emergence of the Islamic State 
that Al-Mourabitoun would start to split. In May 2015, the afore- 
mentioned al-Sahraoui released an audio message in which he 
pledged allegiance to Abu Bakr al-Baghdadi and the Islamic State 
on behalf of Al-Mourabitoun, declaring the formation of a new 
group called the Islamic State in Greater Sahara (ISGS).!* This was 


b There have also been substantial tribal and familial ties between the 
groups, as well as overarching business interests that transcend the 
movements. These relationships undoubtedly contributed to why this 
exceptionalism occurred. See, for example, Dalia Ghanem, “Jihadism In The 
Sahel: Aqim’s Strategic Maneuvers for Long-Term Regional Dominance,” 
Carnegie Middle East Center, June 23, 2017, and Katherine Zimmerman, 
“Salafi-jihadi ecosystem in the Sahel,” American Enterprise Institute, April 
22, 2020. 


c_ Internal jihadi documents found in Mali described al-Masri as having been 
sent by al-Qa ‘ida’s senior leadership to the region. See Thomas Joscelyn, 
“Confusion surrounds West African jihadists’ loyalty to Islamic State,” FDD's 
Long War Journal, May 14, 2015. 


quickly rebuffed by the group and Belmokhtar himself, but con- 
firmed a splinter had taken place because it showed that only part 
of the group had defected to the Islamic State.’ Regardless of the 
confusion, it was clear that the Islamic State now had its first loyal 
band of fighters in the Sahel.* 

In late 2015, Al-Mourabitoun minus the defectors, renewed 
its loyalty to al-Qa ‘ida by joining AQIM’s Saharan branch,”? her- 
alded by a series of successive terrorist attacks in Mali,”! Burkina 
Faso,”? and Ivory Coast.?? In March 2017, AQIM’s Sahara wing, 
along with Al-Mourabitoun and two other franchises, the AQIM 
front group Ansar Dine and its southern Malian contingent Katiba 
Macina, merged to form the Group for Support of Islam and Mus- 
lims (JNIM).”* Iyad Ag Ghaly, the Tuareg leader of Ansar Dine, was 
given the reins over the conglomerate and pledged his allegiance to 
Abdelmalek Droukdel of AQIM, al-Qa‘ida’s Ayman al-Zawahiri, 
and Hibatullah Akhundzada of the Afghan Taliban. 

To make the groups, leaders, and affiliations discussed in this 
article clearer, the authors have delineated these relationships in 
Table 1. 


Table 1: Overview of the Sahelian jihadi constellation since 2012, 
including top leaders, dates of existence, and relationships with 
other groups. 


saci 


Al-Qa ‘ida in 
the Islamic 
Maghreb 
(AQIM) 


AQIM’s Saharan 
branch is a 
constituent group 
of JNIM. 


Abdelmalek 
Droukdel (de- 
ceased)° 


2007- 
present 


Splintered from 
AQIM’s Saharan 
branch in 2011, 
before merging 
with Al-Mu- 
lathimin to form 
Al-Mourabitoun 
in 2013 


Ahmed al-Tilemsi 

Movement | (deceased), Sultan 

for Oneness | Ould Bady, Hama- 

and da Ould al- 

Jihad in Kheiry (or Kheir- 
West Africa ou), and Adnan 

(MUJAO) | Abu Walid al-Sah- 

raoui 


Splintered from 
AQIM’s Saharan 
branch in 2012, 
before merging 
with MUJAO to 
form Al-Mourabi- 


Mokhtar 
Belmokhtar (fate 
not clear) 


AL 
Mulathimin 


toun in 2013 


d_ While this was the first official Islamic State group in the region, Hamada 
Ould al-Kheiry, who would later join the Islamic State, penned a letter in 
support of the group and its proclaimed caliphate almost a year prior to 
the formation of ISGS. Additionally, while ISGS first emerged in May 2015, 
it would not be officially recognized by the Islamic State until over a year 
later. See Hamada Ould al-Kheiry, “Azawadi Support for the Islamic State,” 
July 10, 2014. 


e Following his death in northern Mali in early June 2020, a successor has yet 
to be publicly named by AQIM. 
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Abu Bakr al-Masri 
(deceased), 
Ahmed al-Tilemsi 
(deceased), 
Mokhtar 
Belmokhtar (fate 
not clear), 
Mohamed Ould 
Nouini (deceased), 
Himama Ould 
Lekhweir 


Iyad Ag Ghaly 


Sultan Ould Bady 


Amadou Kouffa 


Adnan Abu Walid 
al-Sahraoui; 
Abdelhakim 
al-Sahraoui 


Al-Mourabi- 
toun 


Ansar Dine 


Katiba 
Salaheddine 


Katiba 
Macina 


Islamic 
State in the 
Greater Sa- 
hara (ISGS) 


Ibrahim Dicko 
(deceased); Jafar 
Dicko 


Ansaroul 
Islam 


Group for 

Support of 

Islam and 
Muslims 
(JNIM) 


Iyad Ag Ghaly 


2013- 
2015 
2011- 
2017 
2013- 
2017 


2015- 

2017 

2015- 
present 


2016- 
present 
2017- 
present 


Formed as a 
merger between 
MUJAO and Al- 

Mulathimin before 
the group, minus a 
pro-Islamic State 
faction, joined 
AQIM!’s Saharan 
branch in 2015. It 
is a constituent 
group of JNIM. 


Formed as a 
Tuareg jihadi 
group in northern 
Mali in late 2011 
and was subse- 
quently utilized as 
a front group for 
AQIM. It is a 
constituent group 
of JNIM. 


Formed as a 
splinter from 
MUJAO and 
briefly joined 
Ansar Dine before 
becoming an 
independent unit. 
Loosely tied to 
JNIM before it 
joined ISGS in 
2017. 


Formed in 2015, 
it acts as Ansar 
Dine’s branch in 
central Mali. It is a 
constituent group 
of JNIM. 


Islamic State’s 
Sahelian affiliate 
that emerged as 

a splinter from 

Al-Mourabitoun in 
2015 


Burkinabe jihadi 
group formed in 
2016 that acts asa 
de facto 
constituent group 
of JNIM, although 
it is officially 
an independent 
group 
Formed as a merg- 
er between Ansar 
Dine and its Katiba 
Macina, AQIM’s 
Saharan Branch, 
and Al-Mourabi- 
toun in 2017 


What Drove and Embodied the Special Relationship 

Despite the early defection of a wing of Al-Mourabitoun and pub- 
lic disagreements over who actually joined the Islamic State, this 
did not stop the local wings of two global jihadi franchises from 
communicating or even cooperating on the ground in the Sahel. 
In this respect, the authors assess there were two main sources of 
cooperation between JNIM and ISGS: amicable personal relation- 
ships along with crossovers of personnel and coordinated actions. 


Personal Relationships and Crossovers of Personnel 

The first and perhaps most important driver of cooperation be- 
tween JNIM and ISGS was that senior members of both organi- 
zations maintained interpersonal ties with each other despite be- 
longing to rival groups. The web of relationships was to a significant 
degree a function of the just discussed common origin story of both 
entities. The amicability this produced was a key manifestation of 
the special relationship. This is perhaps unsurprising as the deep 
historical ties between local clans and tribes have transcended the 
group labels, allowing for a greater ease in cooperation.' As such, 
these close relationships formed by the shared roots in the AQIM 
network and years of fighting together in the Sahel contributed to 
the so-called “Sahelien exception.” 

This can be seen when, almost a year after the creation of the 
so-called ‘Islamic State in the Greater Sahara; Saharan al-Qaida 
commander Yahya Abu al-Hammam was quite open about AQIM’s 
ongoing relationship with al-Sahraoui and the would-be Islamic 
State group.‘ In a January 2016 interview with Al-Akhbar, a Mauri- 
tanian news outlet, al-Hammam was even asked about his relation- 
ship with al-Sahraoui and his group, stating that “it is still anormal 
relationship and we have a connection with them.”°" 

In addition to relationships between leaders of groups, evidence 
has also emerged about the presence of lower-level liaisons that 
have worked to maintain relations between the two groups, who 
likely benefited from the common origins of both organizations. 
For instance, local media has reported that Amadou Kouffa, the 
emir of JNIM’s Katiba Macina, personally met with Iliassou Djibo 
(or Petit Chafori), a Fulani emir within ISGS with a long history of 
previously being within the al-Qa ‘ida milieu in the Sahel, in early 
2017 to discuss cooperation.”7' Perhaps most notably, however, at 


f The commander of U.S. Special Operations Command Africa stated in an 
interview published in the February 2020 edition of this publication: “There 
are obviously historical ties between these groups [JNIM and ISIS-GS] 
that span clans, span tribes, and go from the leadership all the way down 
to the local fighters. This allows the ISIS and al-Qa ‘ida affiliates here [to] 
cooperate in [a] way we don’t see anywhere else.” Jason Warner, “A View 
from the CT Foxhole: Brigadier General Dagvin R.M. Anderson, Commander, 
U.S. Special Operations Command Africa,” CTC Sentinel 13:2 (2020). 


g While ISGS first emerged in May 2015, it would not be officially recognized 
by the Islamic State until over a year later. See Thomas Joscelyn and Caleb 
Weiss, “Islamic State recognizes oath of allegiance from jihadists in Mali,” 
FDD’s Long War Journal, October 31, 2016. 


h_ Al-Akhbar and other Mauritanian news outlets have a history of relaying 
information and statements from al-Qa ‘ida and other related groups. 


i Chafori was previously a member of MUJAO before being arrested by 
French forces in early 2014. Later that year, he was released in a prisoner 
exchange for French AQIM hostage Serge Lazarevic. It is unclear when 
exactly Chafori joined ISGS. See “Frontiére Niger-Mali : mettre l’outil 
militaire au service d'une approche politique,” International Crisis Group, 
June 12, 2018. 
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least three individuals from al-Qa ‘ida’s ranks were identified by the 
United Nations as having acted as liaisons to al-Sahraoui’s ISGS. 
In August 2018, the UN Panel of Experts on Mali identified Abdal- 
lah Ag Albakaye, a senior leader based in Talataye within JNIM’s 
constituent group Ansar Dine, as a coordinating official between 
JNIM and ISGS in the Gao region of northern Mali.”* Several ISGS 
fighters arrested by a joint force of French soldiers and Tuareg and 
Dawsahak militiamen also said that they received orders from Ta- 
lataye and specifically mentioned Abdallah Ag Albakaye.?? Another 
commander and senior aide of JNIM emir Iyad Ag Ghaly, Malick 
Ag Wanasnate, was in charge of these liaison efforts near In-De- 
limane in Mali’s Menaka region until his death in early 2018, ac- 
cording to the United Nations.*° Following Wanasnate’s death, the 
United Nations reported that Faknan Ag Taki, a JNIM commander 
in northern Menaka, took over this responsibility." 

Another JNIM commander, Almansour Ag Alkassoum, who act- 
ed as JNIM’s emir in the Gourma region,” has also played a role in 
facilitating meetings with ISGS. For example, a summit in late 2017 
between ISGS figures and Alkassoum related to ending what JNIM 
regarded as ISGS’ excessive civilian-targeted violence against Imgh- 
ad Tuareg and Dawsahak communities amid the jihadi groups’ con- 
flict with two pro-government Tuareg militias. Following this meet- 
ing, Iyad Ag Ghaly, the overall emir of JNIM, appeared in a video in 
July 2018 and warned against “killing fellow Muslims,’ referring to 
the various ethnic battles being fought across Mali.** 

Another individual known as Fally Ould Kadana, a member of 
ISGS, was named by a former Malian rebel fighter as an interme- 
diary working with JNIM commander Inkarouta Ag Nokh in Ma- 
lis Menaka region.** And in early November 2018, French forces 
arrested a jihadi commander known as “Marouchet,’ a longtime 
veteran in al-Qa ‘ida’s ranks in the Sahel, near In-Ates, Niger.*° 
Reporting suggests he was heavily tied to both ISGS and JNIM,*® 
illustrating the fluidity between the two organizations. 

In addition to liaisons and meetings between JNIM and ISGS, 
the two groups, according to the authors’ assessment, found it easier 
to find common ground because of crossovers of personnel. The 
Sahel’s long history of militancy, in which armed groups have often 


j On June 1, 2017, a joint force composed of French Barkhane forces as well 
as Movement for the Salvation of Azawad and Imghad Tuareg and Allies 
Self Defense Group militiamen, in coordination with Malian and Nigerian 
regular forces, carried out an ambush in Tissalatene on an ISGS convoy 
returning from Abala, Niger, where the Islamic State militants had attacked 
a gendarmerie camp. The involvement of the militias in this operation 
pushed ISGS and JNIM to ally up to fight them in Gao and Menaka. The 
ambush infuriated ISGS emir Al-Sahraoui who issued a fatwa against the 
Imghad Tuareg and Dawsahak, rendering it “halal” to seize their belongings 
and livestock. JNIM, which likely did not agree on the legal basis for the 
fatwa because as a group it has been more focused on building broad 
popular support, opposed the move. In the wake of al-Sahraoui’s fatwa, 
attacks and abuses against Imghad and Dawsahak civilians escalated, 
spurring JNIM to send a delegation led by Alkassoum to ISGS in late 2017, 
a summit that resulted in heated arguments between the camps. Notably, 
Alkassoum and his aide Hamada (also present at the reported meeting) 
originate from the Imghad and Dawsahak communities, respectively, 
indicating that the JNIM commanders likely responded to complaints from 
their respective communities. Héni Nsaibia interview, local area expert from 
Gao, Mali, May 2019. 


drawn from a common pool of fighters,* has allowed for a greater 
fluidity of militants among the region’s many armed groups. Indi- 
viduals without any defined allegiance, who act as what could be 
termed ‘armed group nomads, often shift from group for hyper-lo- 
calized tribal dynamics or transactional purposes. The networks 
from which JNIM and ISGS are constituted are exceptionally com- 
plex with ethnic and tribal interconnections often transcending lo- 
cal, regional, and global jihadi affiliations, therefore making JNIM 
and ISGS (at least for a while) somewhat resistant to the forces 
driving al-Qa ‘ida and the Islamic State apart in other parts of the 
world. 

One such ‘armed group nomad’ cited in a recent U.N. report is 
Najim Ould Baba Ahmed (or Nweijam), who is frequently men- 
tioned in the context of militant activities in the Mali-Niger bor- 
derlands. He has, at various times, been called a member of MU- 
JAO, Al-Mourabitoun, and of several militias such as the loyalist 
and ex-rebel factions of the Arab Movement of Azawad and the 
High Council for the Unity of Azawad (HCUA).” Interchangeably 
described as a commander and facilitator, Nweijam is suspected of 
leading a group of 30-40 Fulani Tolebe combatants that is believed 
by the United Nations to have carried out several attacks against 
local and foreign forces in the area of In-Delimane.**' It is likely that 
Nweijam has also facilitated attacks for ISGS given his stronghold 
within the group’s zone of influence.” 


Coordinated Actions 

Beyond the amicable personal relations and exchanges of personnel 
as described above, joint and coordinated actions also help forge the 
special relationship between the groups. Though more may exist, 
at least five instances of ISGS-JNIM cooperation in raids can be 
cited. Significantly, in none of these instances were there dual or 
competing claims by the groups, unlike for other attacks discussed 
later in this section. Instead, in each of the five instances, the attack 
was claimed by one of the groups while independent reporting later 
found that militants from both ISGS and JNIM took part in the 
raid. First, in November 2017, the two groups launched a coordi- 
nated assault on a joint MINUSMA and Malian military grouping 
in the area of In-Delimane, located between Ansongo and Menaka 


k Drawing from acommon pool of fighters produced commonalities between 
groups in the Sahel, making cooperation easier. One example of this 
was JNIM and the High Council for the Unity of Azawad (HCUA), which 
originated from a splinter of Ansar Dine that left the group in 2013 following 
the French intervention in Mali. As a result of shared tribal affiliations 
and origins, militants belonging to HCUA were, as of 2019, alleged to still 
be maintaining ties to and cooperating with JNIM. See Arthur Boutellis 
and Marie-Joelle Zahar, “A Process in Search of Peace: Lessons from the 
Inter-Malian Agreement,” International Peace Institute, June 2017, p. 10, 
and “Letter dated 6 August 2019 from the Panel of Experts established 
pursuant to resolution 2374 (2017) on Mali addressed to the President of 
the Security Council,” United Nations Security Council, August 7, 2019, pp. 
23, 26-27. 


| The trajectory of Nweijam may also reflect the difficulties smaller tribes 
and their allies face in positioning themselves vis-a-vis stronger tribes and 
the often-predatory armed groups operating in the areas they inhabit. 


m_ For instance, the ISGS force that struck the Nigerien military base in In- 
Ates in a July 2019 attack is believed to have prepared for the assault at a 
checkpoint in Mali run by Nweijam. See “Niger: l’attaque d’Inates aurait été 
préparée depuis un checkpoint situé au Mali,” RFl, August 18, 2019. 
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Figure 1: Insurgent Area of Operations in Mali, Burkina Faso, and Western Niger January 2016-June 2020). The map illustrates where 
both JNIM, as well as its constituent groups, and ISGS have historically operated in the Sahel since January 2016. (Jules Duhamel) 


in northeastern Mali.*9" Then, on May 14, 2019, ISGS fighters car- 
ried out a complex ambush near Tongo Tongo, Niger, which killed 
almost 30 Nigerien troops.*° It was later indicated that a JNIM 
commander identified as Inkarouta Ag Nokh (or Abu Alghabass) 
reportedly provided fighters for the operation, after which spoils 
were shared between the organizations.“ 

Not long after that assault, ISGS carried out another large-scale 
attack against a military outpost in Koutougou, Burkina Faso, in 
August 2019.*? However, the French researcher Mathieu Pellerin 
assessed in a December 2019 report that it was likely another joint 
assault with JNIM.* A month later, JNIM claimed a near-simul- 


n_ While JNIM claimed responsibility for the In-Delimane attack, an ISGS 
lieutenant based in In-Ates from the Tuareg Imouchag tribe provided 
fighters for the assault. Héni Nsaibia interview, local area expert from the 
Tuareg community in Niger, November 2018. 


taneous assault against a Malian national guard camp in Mondoro 
and the base of the regional G5 Sahel Force in Boulkessi, both situ- 
ated in central Mali’s Mopti Region along the border with Burkina 
Faso.** Similarly to Pellerin, a coordinator for a Sahel-based NGO 
made the observation to one of the authors that ISGS fighters took 
part in the double attack.*° 

Finally, on December 10, 2019, ISGS launched the single deadli- 
est attack on security forces recorded in Niger, killing more than 70 
soldiers.*® Afterward, Malian media reported that two of the fight- 
ers killed in jihadi ranks were members of the Malian rebel group 
HCUA, but they were locally identified as actually affiliated with 
JNIM, indicating that the raid was likely supported by JNIM.* It 
is evident that these instances were part of a larger coordinated of- 
fensive in the Liptako-Gourma (or tri-state border area of Mali, Ni- 
ger, and Burkina Faso) in which numerous military outposts were 
successively overrun by both groups. This forced the militaries of 
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each respective country to tactically withdraw from their respective 
border areas, leaving previously contested areas under JNIM and 
ISGS control.** 

In some instances, operations claimed by each organization 
appeared to show some levels of coordination between the fran- 
chises—though without partaking in joint raids. Take, for example, 
when ISGS militants assassinated Hamid Koundaba, the mayor 
of Koutougou, Burkina Faso, on April 8, 2018.*° On the very next 
day, JNIM claimed responsibility for an IED on Burkinabe forces 
who were sent to reinforce the area following the assassination.”° 
This type of coordination was also seen in the intermittent conflicts 
between the jihadis and a variety of groups such as the pro-Bamako 
Tuareg and Dawsahak militias, the Imghad Tuareg, the Allies Self 
Defense Group (GATIA), and the Movement for the Salvation of 
Azawad (MSA) in the Menaka region of Mali. In early 2019, JNIM 
trumpeted being at war with MSA and GATIA by claiming a series 
of attacks in the Gao and Menaka regions.*! These attacks were oc- 
curring simultaneously with assaults by ISGS against the militias.” 
The United Nations has also confirmed specific instances of where 
JNIM and ISGS have cooperated, including the aforementioned 
attacks on GATIA and MSA in Menaka.** 

As outlined above, there have been several instances of JNIM 
and ISGS cooperation in Mali. In Kidal in northern Mali, JNIM 
leader Ag Ghaly’s historical stronghold,** ISGS was able to operate 
unimpeded as shown by several attacks in Algeria just across the 
Algeria-Mali border, likely indicating a certain degree of acceptance 
on the part of JNIM. In fact, these attacks indicate ISGS continued 
to have a presence in the area until at least late 2019, months after 
clashes began between the groups in other regions.*°° 

The two groups also may have coordinated a hostage-taking op- 
eration in Benin. In May 2019, two French tourists were kidnapped 
by jihadis in northern Benin who then took the pair to Burkina 
Faso where they were to be transited to northern Mali.** The two 
were later freed in a French special forces operation in Burkina 
Faso, during which two French soldiers were killed.” After the raid, 
French officials stated that the group that sponsored the operation 
was JNIM’s Katiba Macina without referring to the group actually 
holding the hostages.** But it was reported by the French publica- 
tion Le Monde that Burkinabe intelligence found that the kidnap- 
ping in Benin was performed by militants linked to ISGS who were 
then going to transfer the French nationals to Katiba Macina.°9? 

Cooperation between JNIM and ISGS has also been reported 
by French and U.S. military officials. For instance, General Bru- 


o Several ISGS fighters relocated from Gao to the area around Kidal in the 
2018-2019 period. One of them was Aboubacar Ould Abidine, successor 
and cousin of Sultan Ould Bady, MUJAO’s co-founder who in 2013 created 
his own group, Katiba Salaheddine, in Mali’s Gao region. The Algerian 
military killed Ould Abidine in an air-supported operation on November 
18, 2019, in Tawendert, Algeria. See, for instance, Menastream, “#Algeria- 
#BREAKING: Aboubacar Ould Abidine (aka Abu Zoubeir), cousin & Katiba 
Salaheddine/#ISGS lieutenant of #MUJAO ...,” Twitter, November 21, 2019. 


p_ To date, it has not been confirmed that ISGS militants were the hostage- 
takers in this operation. The authors believe this may be explained by 
Burkinabe authorities underestimating Katiba Macina’s influence in the 
area concerned. The Burkinabe intelligence assessment may also have 
been influenced by reports that a Beninese tourist guide was shot dead 
and beheaded during the hostage-taking, a modus operandi that Burkinabe 
authorities probably viewed as indicative of Islamic State militants being 
the perpetrators. See “Bénin : ‘Le guide a été tué par balle et décapité, 
selon un source locale,” France24, May 6, 2019. 


no Guibert, the former overall commander of France’s Operation 
Barkhane in the Sahel, confirmed in 2018 that JNIM and ISGS 
have launched joint assaults across the Sahel, though he cautioned 
against the idea of any grand alliance between the groups. For 
his part, Brigadier General Dagvin R.M. Anderson, commander 
of U.S. Special Operations Command Africa, noted in an interview 
published in February 2020 that the United States had indentified 
instances where JNIM and ISGS have cooperated and coordinated 
in attacks.” 

General Anderson was speaking after clashes had erupted be- 
tween ISGS and JNIM but before the relationship between them 
had fully deteriorated. His view at the time was that “JNIM provides 
unity of purpose, unity of effort but not necessarily unity of com- 
mand. JNIM and ISIS-GS operate together and even coordinate 
attacks together.’ Anderson also stated that JNIM and ISGS were 
“less concerned about who has complete control locally, focusing in- 
stead on propagating their extremist ideology and working toward 
the greater cause of establishing an Islamic State.” Like his French 
counterpart, he stopped short of implying a grand merger between 
al-Qa ‘ida and the Islamic State in the Sahel. 

Indeed, it should be noted that there were several instances of 
dual claims wherein both groups claimed responsibility for the 
same attacks. This includes a February 2018 IED attack against a 
Barkhane convoy near In-Delimane that was initially claimed by 
JNIM, for which ISGS later took credit. Almost a year later, sev- 
eral attacks were separately claimed by both JNIM and ISGS in the 
Mansila area in Burkina Faso’s Yagha Province in January 2019. 
Anda March 2020 ambush against the Malian army near Boulkessi 
was also claimed by both organizations with identical statements.” 
While dual claims may signal competition, it could also indicate 
difficulties JNIM and ISGS face in distinguishing themselves from 
one another, especially with regard to how their respective chains 
of command identify actions by the rank-and-file. 

In sum, while it was always very unlikely that JNIM and ISGS 
would merge, it was evident the groups oftentimes coordinated 
their efforts against shared enemies and even had designated com- 
manders in various areas across the region to facilitate this rela- 
tionship. 

Thus, as shown above, ISGS and JNIM'’s historically non-violent 
relationship has been the product of more than mere non-aggres- 
sion: instead, as evidenced from personnel exchanges and par- 
ticipation in multiple attacks together, the non-violent armistice 
between them was in part the result of occasional cooperation, not 
merely ignoring one another. 


Part Two: Descent into Open Warfare 

The special relationship between ISGS and JNIM forged by com- 
mon origins, personal connections, crossovers of personnel, and co- 
ordinated actions eventually gave way to the same levels of hostility 
seen elsewhere between the Islamic State and al-Qa ‘ida. Part two 
of this article first documents the clashes between ISGS and JNIM 
that began in the summer of 2019. It then explains the collapse of 
the special relationship by identifying and examining several driv- 
ers toward conflict. 


The Clashes Between ISGS and JNIM 

Based on data compiled by the authors, ISGS and JNIM have 
physically clashed at least 46 times across the Sahel beginning in 
July 2019 in the Mali-Burkina Faso border region. Since then, the 
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fighting has shifted from Mali’s Inner Niger Delta and the Gourma 
Region of Mali and Burkina Faso, to areas of Burkina Faso’s eastern 
provinces along the borders with Niger and Benin. 

According to estimates by the Armed Conflict Location and 
Event Data Project (ACLED), more than 300 jihadis have been 
killed on either side as the result of these armed engagements since 
the start of the clashes. The International Crisis Group also stated 
in an April 2020 briefing that fighting in Burkina Faso’s Soum Prov- 
ince alone that month “left at least 100 [jihadis] dead.””° As such, 
it is clear that the “Sahelian exception” once enjoyed by both JNIM 
and ISGS is now over. 

The war between JNIM and ISGS began in earnest in July 2019 
after a firefight in the Burkinabe border village of Ariel.” Another 
confrontation was reported in Mali in September 2019 in Haous- 
sa-Foulane between Gao and Ansongo.” In December 2019 and 
January 2020, clashes between the groups were reported in south- 
ern Mondoro (Douentza), Dogo (Youwarou), and In-Abelbel (Gour- 
ma-Rharous).” 4 The clashes intensified in 2020. In March 2020, 
fighting between JNIM and ISGS was reported near the Mauritani- 
an town of Fassala, which sits on the border with Mali.™ Except for 
Haoussa-Foulane and In-Abelbel, all of these locations sit within 
the areas of operation for JNIM’s Katiba Macina, showing that this 
conflict largely began within its zone of influence as it tried to push 
ISGS away from the Inner Niger Delta before spreading to other 
areas and other katibas. 

Despite these clashes, it was not until a May 2020 issue of the 
Islamic State’s weekly Al Naba newsletter that either side openly 
acknowledged the violent clashes between them in the Sahel. The 
Al Naba article discussed fighting between the two jihadi heavy- 
weights in both Mali and Burkina Faso, as well as the Burkina Fa- 
so-Niger border region over the previous month. In central Mali, 
the Islamic State reported that its men “repulsed two attacks” by 
JNIM in Mali’s Mopti region. It also specifically mentioned the area 
near Nampala, which sits close to the borders with Mauritania, and 
the areas “east of Macina” in the Segou region.” Local media re- 
ported fighting between the jihadi groups in these same areas over 
the few prior weeks, adding some credence to the Islamic State’s 
claims. For instance, in early April 2020, clashes were reported in 
the localities of Dialloube,”* Koubi, Diantakaye, and Ninga in the 
Mopti region.”” 

The Islamic State’s May 2020 newsletter also makes notes of 
further clashes south of Boulkessi, Mali, in the weeks prior.”* Much 
like the jihadi-on-jihadi fighting in Mali’s Mopti region, battles have 
also been widely reported in the Gourma area of Mali and Burkina 
Faso. For instance, on April 13, 2020, the Islamic State launched an 
attack on JNIM’s men near the locality of Tin-Tabakat.” 


q_ Theclashes between JNIM and IGSS in Dogo received significant attention 
as two ISGS fighters were killed and eight others taken prisoner, which 
caused JNIM a minor media imbroglio. A fake claim of responsibility 
attributed to JNIM was released online that was reported on by local media. 
This caused the group to then release an official statement calling the 
previous claim fake and denying any responsibility for the clashes in Dogo. 
It also took the opportunity to declare that it does not generally target 
Muslim or Christian populations, including marketplaces and churches. 
This was a way of distinguishing itself from, and subtly putting the blame 
for such attacks on, ISGS. See Amachagh, “Dans un communiqué publié 
par @Az_Zallaqa sur son compte sur la plateforme #Tamtam le 27.1.2020 
.. Twitter, February 18, 2020, and Menastream, “#Mali: #JNIM refutes 
a fake statement attributed to the group related ...;’ Twitter, February 20, 
2020. 


Three days later, another skirmish between JNIM and ISGS 
was reported by Al Naba near the village of In-Tillit in Mali’s Gao 
region.*° While this claim was not backed by local reporting, the 
United Nations has noted that the Islamic State has increased its 
presence inside Gao earlier this year, making this instance entirely 
plausible. 

On April 18, 2020, one of the largest battles so far between 
the two reportedly took place in the Ndaki area of Mali’s Gossi 
commune. According to local media, a large contingent of JNIM 
fighters targeted the Islamic State’s men in four different villages 
in the area.*? Malian and Burkinabe media stated that as many as 
40 vehicles were in the JNIM convoy. The Islamic State appears to 
have confirmed these events, albeit on a different date. According 
to the group, JNIM targeted Islamic State positions in the Boula 
area, west of Korfooueyouey' on the Mali-Burkina Faso border area, 
with “dozens of motorcycles and vehicles” on the Islamic calendar 
date corresponding to April 26, 2020. The Islamic State further 
contended that its men gained the upper hand during the battle fol- 
lowing a suicide car bomb against al-Qa ‘ida’s men.** It also claimed 
to have captured 40 motorcycles and three vehicles from JNIM.** 

On April 20, 2020, another firefight was recorded near the lo- 
cality of Pobe inside Burkina Faso’s Soum province,* while another 
occurred in Kerboule in the Koutougou department of the same 
province.* Further battles near the Burkina Faso towns of Arbinda 
and Nassoumbou have also been reported.*” 

Another issue of Al Naba, released in June 2020 made the first 
explicit reference to clashes with Ansaroul Islam.** In the June 2020 
newsletter, the Islamic State claimed that Jafar Dicko, the leader of 
Ansaroul Islam, founded with support from JNIM's constituent 
groups,® allegedly lost over 170 fighters in clashes in late May 2020 
with the Islamic State’s men in the border region between Mali and 
Burkina Faso.°° Another clash in Burkina Faso between JNIM and 
ISGS was reported near Ghana in the aforementioned June 2020 
Al Naba issue,*' which likely correlates to a confirmed incident near 
Pama, Burkina Faso, on May 28, 2020.° Fighting in Burkina Faso’s 
Yagha Province, which is close to the border between Burkina Faso 
and Niger, was also reported in late May 2020.%* 

Al-Qaida channels on Telegram had a different version of 
events, however. The al-Qa ‘ida loyalists argue that Al Naba’s retell- 
ing of events were lies, while adding that JNIM had killed several 
ISGS members in Burkina Faso in recent weeks.** Another state- 
ment posted by pro-al-Qa ‘ida sources alleged that Abdelmalek 
Droukdel ordered JNIM to “eradicate the Islamic State and eradi- 
cate them from land of the mujahideen,’ implying that Droukdel’s 
role in the fighting between Islamic State and al-Qa ‘ida franchises 
in the region was much deeper than previously thought.** But the 
details in both of these statements have not been confirmed. And as 
of the time of publishing, official al-Qaida channels have so far not 
publicly commented on the fighting between both groups. 


The Drivers Toward Conflict 

What factors then led a once amicable—and cooperative—relation- 
ship to turn into outright violence? The growing tensions between 
ISGS and JNIM were, the authors assess, the result of several differ- 
ent factors. One likely driver is the longstanding ideological differ- 


r The Boula area is the local Fulani name for the waterhole-filled areas 
stretching from Gountouré in Burkina Faso to Tin-Tabakat in Mali. 
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ences between the groups. Whereas previously these were glossed 
over, in recent months—as will be described below—they have been 
increasingly starkly articulated by both sides, further cementing the 
ideological divide. A second likely factor that drove the two groups 
toward conflict, and that helped cement the ideological divide, was 
ISGS formally becoming a regional subunit of the Islamic State’s 
West Africa Province in March 2019, with Islamic State Central 
taking over ISGS’ media output from that time onward.” This pre- 
sumably resulted in Islamic State Central pushing its satellite to- 
ward confrontation and taking a more confrontational approach as 
evidenced by the increasingly hostile discourse in its propaganda. 
A third likely factor was the growing ambition shown by ISGS after 
it formally became part of ISWAP. Another likely driver was their 
sharply different treatment of the local population. A fifth likely 
factor was the fallout from defections. As will be outlined, given 
these forces pulling the groups apart, attempts to mediate between 
them failed. 


Ideology 

As time went by, it was perhaps inevitable that the deep-seated 
ideological differences that always existed between ISGS and JNIM 
would challenge their special relationship. In recent months, JNIM 
and ISGS have released several pieces of propaganda that have ad- 
dressed the ideological differences plaguing the two organizations. 

The first in this volley of propaganda was a series of pamphlets 
released by JNIM in early 2020.” Penned by Qutaybah Abu Nu- 
man al-Shinqiti, a Mauritanian religious scholar affiliated with 
AQIM,°* the booklets were addressed to both JNIM’s detractors 
though neither explicitly mentions ISGS by name.” 

The first pamphlet, which was addressed to those who have 
criticized JNIM’s implementation of sharia law, argues for what it 
portrays as al-Qa ‘ida’s slower and more calculated approach in its 
implementation as a counter to the Islamic State’s quick and often 
heavy-handed approach. The second booklet can be viewed as a call 
to restore unity among JNIM and ISGS. The booklet, entitled “Year 
of the Group,’ recalled the story of the historical Hasan-Muawiyah 
treaty as an analogy for the current challenges in the Sahel.’ In Shin- 
qiti’s retelling of the story, the ideologue makes an appeal to jihadis 
in the Sahel to also come together to prevent further clashes and 
disagreements. 

Around the same time as the pamphlets, several audio messages 
from JNIM commanders were released in local languages, includ- 
ing Tamachek, Fulfulde, and Arabic, which focused on doctrinal 
divergences between JNIM and ISGS. One such audio message 
in Tamachek (or Tuareg language) was representative of the other 
messages in its warning against the recent arrival of the “khawar- 


s_ That treaty, which occurred in the early days of Islam, stipulated that 
Hasan (the grandson of Muhammad and son and successor to Ali as caliph 
following the former's assassination) would abdicate as caliph in favor of 
his father’s rival Muawiyah. That peace accord was originally designed to 
prevent further conflict between the two rival camps. See “The Terms of the 
Peace Treaty,” Al Islam. 


77” in the Sahel, describing the Islamic State’s arrival “as a test for 
the mujahideen in order to separate the true [believers] from the 
false.”1° 

This exact sentiment would again surface following severe clash- 
es between JNIM and ISGS. In an unofficial video produced for 
local consumption dated June 1, 2020, JNIM showcased purported 
spoils of war seized in fighting with ISGS.'" Throughout the clip, 
one of the jihadis featured repeatedly refers to the adversary [ISGS] 
by the pejorative term “khawarij” 


A Push Toward Confrontation by Islamic State Central 
In March 2019, a photo was released online showing Islamic State 
fighters in Burkina Faso branded as the Islamic State West Africa 
Province (ISWAP).!” This photo was intended to denote that ISGS 
had formally been subsumed under the Islamic State’s West Africa 
Province, which is largely based in and around northeastern Ni- 
geria. This restructuring in effect produced two regionally distinct 
subgroups within the Islamic State province, with ISGS becoming 
more integrated into the Islamic State’s overall structure, including 
its media apparatus. For example, at some point in 2019 follow- 
ing the rebranding under ISWAP, an ISGS cell was created along 
the border between Mali and Algeria.°? Anecdotal evidence has 
since suggested that this cell may have been an attempt by Islamic 
State Central to establish operational oversight by using Islamic 
State-Libya operatives as middle management.’ With likely great- 
er control over its affiliate, Islamic State Central was seemingly able 
to push it to take the same confrontational approach toward al-Qa- 
‘ida in the Sahel as the Islamic State had globally. In turn, this likely 
led to spiraling tensions and the groups to not only starkly articulate 
their ideological differences in a war of words, but also to go to war 
with each other in some parts of the Sahel. 

Prior to March 2019, ISGS primarily relied on its own rudimen- 
tary media infrastructure to produce its propaganda as its commu- 
nications with the Islamic State’s central media remained sporadic 
at best.’° Following the formal restructuring of ISGS under the 
Islamic State West Africa Province brand in March 2019,'°° most 
media statements including videos and photos produced by ISGS 
have been released through the Islamic State’s official media appa- 
ratus.!°7 This has allowed the Islamic State to push the messaging 
toward more hostile criticism of JNIM to suit its general narrative. 
The subsuming of ISGS into the West Africa Province and the more 
confrontational tone likely antagonized JNIM with ISGS no longer 
viewed as ajunior ally to the Sahelian al-Qa ‘ida franchise, but now 
a potent competitor challenging its hegemony, which needed to be 
confronted. 

The Islamic State sharpened its criticism of JNIM after Qutay- 
bah Abu Numan al-Shinqiti’s opening salvo earlier this year. Just a 
few months after al-Shinqiti’s pamphlets were released, the Islam- 
ic State began to incorporate the local Sahelian tensions into its 
global propaganda. For example, the Islamic State highlighted the 


t This term references an early extremist sect of Islam that defected from 
the Caliph Ali and that would later assassinate him. In Muslim countries, 
this has become a popular insult against the Islamic State and is often 
used by jihadis hostile to the group, including al-Qa ‘ida. See, for instance, 
Mohamed Bin Ali, “Labelling IS Fighters: Knhawarij, Not Jihadi-Salafis,” 
RSIS, April 4, 2018, and Thomas Joscelyn, “Al Qaeda ideologue justifies 
Shabaab’s war with the Islamic State in Somalia,” FDD’s Long War Journal, 
January 23, 2019. 
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ISGS fighters in Burkina Faso, seemingly during a pledge ceremony 


to the Islamic State, in an undated picture obtained by the 


authors in April 2018 


tensions in the Sahel in a video released by its Yemen Province in 
April 2020, which accused al-Qa ‘ida of “deviating” following the 
Arab Spring protests.’°* In regard to the Sahel, the video strongly 
denounced AQIM’s actions in the 2012 jihadi takeover of north- 
ern Mali and condemned AQIM and its then leader, Abdelmalek 
Droukdel, for working with “apostate movements,” namely the Na- 
tional Movement for the Liberation of Azawad, in the occupation." 

Just a few weeks after the Islamic State branch in Yemen’s broad- 
side, the Islamic State Central media apparatus expanded on its 
criticisms of al-Qaida in the Sahel, going so far as to argue that 
the latter had started a war in the region.’ In the aforementioned Al 
Naba newsletter, which for the first time acknowledged the violent 
clashes between the groups in the Sahel, the Islamic State said that 
al-Qa ‘ida “never misses the chance for treachery.” The newsletter 
also made clear that these criticisms were directly aimed at two 
of JNIM’s top leaders, Amadou Kouffa and Iyad Ag Ghally, in that 


u_ This statement made by the Islamic State harkens back to an earlier letter 
penned by Abu Walid al-Sahraoui’s Mujahideen Shura Council in Gao during 
al-Qa‘ida’s takeover. That statement, which was published in late 2012, 
also denounced the National Movement for the Liberation of Azawad for 
being secular and refusing to “implement Islamic Sharia.” See Majlis Shura 
al-Mujahideen in Gao, “To the People of the Cities in Northern Mali about 
the reason for its fight with the MNLA (secular movement),” November 26, 
2012. 


v__ Itis important to note that these criticisms came from outside the region 
and have been coordinated by the Islamic State’s central media apparatus. 
This fits with how the Islamic State has been able to coordinate its media 
and propaganda efforts around the world. See Daniel Milton, Pulling Back 
the Curtain: An Inside Look at the Islamic State's Media Organization (West 
Point, NY: Combating Terrorism Center, 2018). 


the two had “planned the war long ago.”"° Moreover, it also echoed 
earlier complaints made by ISGS field commanders over JNIM’s 
purported willingness to negotiate with the Malian government, 
though JNIM has insisted this would only happen after French 
troops leave the region." 

The most senior Islamic State criticism of JNIM came on May 
28, 2020, in a speech by the Islamic State’s official spokesman, Abu 
Hamza al-Quraishi. In his address, al-Quraishi explicitly accused 
al-Qa ‘ida’s men of working with the Malian government to kill 
the Islamic State’s men in the region."” The spokesman went on to 
further criticize JNIM’s alleged willingness to negotiate with the 
Malian government before calling JNIM “guard dogs” for Algeria 
and accusing it of working with “nationalist and secular groups.”""” 
He even alleged that JNIM has “prevented others from fighting it 
[Algeria]. 

According to al-Quraishi, the fighting between ISGS and JNIM 
across the Sahel began after JNIM “got upset by the news of the 
Islamic State’s conquests” in the region." The spokesman then lam- 
basted JNIM for its handling of defections within its ranks, stating 
that “their backs broke when a large grouping of their followers 
joined the Islamic State." As a result, he stated “they are today kill- 
ing those who left their movement to join the Islamic State in West 
Africa." Highlighting the fluid nature of armed groups in northern 


w_ The phrase “nationalistic and secular groups” is likely a reference to the 
various Tuareg and other ethnic militias that have fought against the 
Islamic State, mainly in Mali. In June 2020, an Al Naba issue was more 
specific in this reference, accusing JNIM of working with the Coordination 
of Azawad Movements, a grouping of Tuareg and Arab nationalist groups, 
against the Islamic State. See Al Naba, Issue 238, June 11, 2020. 
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Mali, al-Quraishi also noted that JNIM “does not stop its followers 
from joining the apostate factions from the secular, to the national, 
or others, and they see them as their brothers in religion.” At one 
point, al-Quraishi took offense at the use of the term “khawarij” 
used by JNIM leaders in local audio messages. 


The Growing Ambition of ISGS 

ISGS, as it has grown in strength, has increasingly sought to usurp 
its position in relation to its historically dominant counterpart in 
JNIM. Its drive for dominance was heightened by its rebranding 
under ISWAP, which has likely afforded Islamic State Central 
more authority over ISGS. As previously discussed, the more for- 
mal integration of ISGS into the Islamic State's fold has also likely 
meant that directives from Islamic State Central have caused ISGS 
to be more aggressive on the ground. This can be seen in at least 
three respects: increased expansion in central Mali, large assaults 
on military positions across the Sahel, and contestation over nat- 
ural resources. Firstly, in central Mali, ISGS has taken advantage 
of internal dissent within JNIM to make inroads in the historical 
al-Qa ‘ida stronghold of the Inner Niger Delta."* As will be dis- 
cussed more in depth later, internal squabbling within JNIM’s 
Katiba Macina has allowed ISGS to poach members from JNIM 
in the region. This has, in turn, afforded ISGS more influence in 
the area. Secondly, ISGS has conducted a series of major assaults 
across the Sahel since the more formal integration into the Islam- 
ic State. In just the past year alone, ISGS has committed some of 
the deadliest attacks in Burkina Faso, Mali, and Niger, indicating 
its growing capabilities."9 Lastly, ISGS’ growth has allowed it to 
challenge JNIM over control for several strategic areas across the 
Sahel, many of these areas rich in natural resources. For instance, 
in the Inner Niger Delta, ISGS is vying for influence over pasture- 
land.° In the Gourma, it has sought more influence in areas near 
artisanal mining sites, such as gold mines.’ Whereas in Burkina 
Faso’s east, it has challenged JNIM’s dominance over wildlife and 
hunting reserves.'” 


Differing Treatment of the Local Population 

At the heart of the current competition between JNIM and ISGS 
is how each respective organization deals with the local communi- 
ties in which they operate and recruit. As both groups are vying for 
power and influence amidst various communal conflicts within the 
Sahel,!”’ each franchise has taken a different approach in order to 
exploit these conflicts for their own respective benefit. 

At the organizational level, JNIM has followed a communi- 
ty-based approach based on al-Qa ‘ida’s modus operandi whereby 
local grievances are exploited and local militants are transformed 
into allied groups.'’** JNIM has attempted to embed itself within 
the local fabric of the Sahel,” often portraying itself as a communal 
defender to such ethnic groups as the Fulani of central Mali.!° Con- 
versely, ISGS has posited itself as a more uncompromising alterna- 
tive to JNIM and preys on more violent or vengeful individuals to 
exacerbate communal conflicts.” 

These differences in how both JNIM and ISGS have interacted 


x Inal-Quraishi’s speech, he explicitly referred to the use of ‘khawarij’ 
in reference to members of the Islamic State’s West African Province 
(ISWAP), under which ISGS operates. However, he mentioned this in the 
context of the fighting between JNIM and the Islamic State’s men in the 
Sahel, making this a reference to the audio messages from JNIM. 


with local communities have been at the forefront of tensions be- 
tween the organizations. For instance, ISGS leaders have openly 
voiced their criticisms over JNIM’s Katiba Macina and how its lead- 
er, Amadou Kouffa, is open to agreements with ethnic Bambara and 
Dogon militias and negotiations with the Malian government.” 
ISGS’ second in command, Abdelhakim al-Sahraoui, has been par- 
ticularly vocal in his criticism of JNIM’s alleged openness to nego- 
tiations with the Malian government and agreements reached with 
Bambara Donsos’ in the Macina (Inner Niger Delta).’”° 

Additionally, land disputes among the Fulani of central Mali 
have also bled into the competition between JNIM and ISGS. As 
outlined by researcher Yvan Guichaoua, JNIM and ISGS have dif- 
fered on the institution of taxes and regulations on pastures used 
by Fulani pastoralists in the areas under their influence.° In con- 
junction with the groups’ increasingly close geographic proximity 
to each other because of their expansion in the region, this has con- 
tributed to the increased tensions. 


The Fallout from Defections 

As ISGS has grown in the region, JNIM has faced several rounds 
of defections to its rival, with the fallout contributing to tensions 
between the groups. 

In one of the first such instances of defections from JNIM to 
ISGS, in the summer of 2017, a group of Tolebe Fulani fighters 
in central Mali belonging to Katiba Macina defected to ISGS.'" 
Around the same time, Katiba Salaheddine, a jihadi outfit led by 
Sultan Ould Bady that was loosely within al-Qa ‘ida’s orbit in the 
Sahel, also joined ISGS.'?” 

These desertions were not lost on JNIM, as it eventually indi- 
rectly responded to these events in a propaganda video released in 
November 2018. In that video, Amadou Kouffa, JNIM’s leader in 
the Macina [Inner Niger Delta], ostensibly called on Fulani across 
West Africa and beyond to wage jihad in the Sahel. However, the 
speech appeared to be more a call for unity amid the aforemen- 
tioned defections to ISGS."*? In the speech, Kouffa addressed all 
Fulani jihadis or “mujahideen” in the region, without being specific 
to any particular group or movement. At one point in the video, 
Kouffa even explicitly stressed that they (the Fulani jihadis) should 
“come together and unite.”** 

Despite the early efforts by JNIM to stem the tide of defections 
to ISGS, it is clear that the initiative failed. Throughout 2019 and 
2020 in neighboring Burkina Faso, segments of Ansaroul Islam 
also saw defections to ISGS in the Centre-Nord region,'** Seno 
Province,'* and in other areas near the border with Mali.” “ These 
defections from Ansaroul to ISGS were the culmination of attempts 
by ISGS to wrest influence over the group away from JNIM since 


y Donsos are members of traditional hunter fraternities in Mandé-speaking 
communities across West Africa. These groups have formed community- 
based militias in Mali and Burkina Faso, united in their pro-government 
stance and campaign against Fulani groups. The Bambara are one of the 
largest ethnic groups in Mali. 


z_ Interestingly, Abu Walid al-Sahraoui had previously rebuked Sultan Ould 
Bady and his Katiba Salaheddine for leaving MUJAO in 2013 and joining 
Ansar Dine. See “Formation of the new Katibat Ansar al Sunnah and Four 
Sarayyas,” Al-Murabitun Foundation for Media Production, January 5, 2013. 


aa With these defections, it is clear that Ansaroul Islam's loyalties were divided 
between a pro-JNIM camp and a pro-ISGS camp. Given the defections to 
ISGS, it is unclear if Ansaroul Islam is still operating on an independent 
basis or if it has been more formally subsumed by JNIM. 
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Ansaroul Islam’s inception in 2016." Starting in late 2019, Katiba 
Macina also saw defections to ISGS in Burkina Faso’s Kossi Prov- 
ince.”9 Then by January 2020, another unit belonging to Katiba 
Macina near Nampala, Mali, also left JNIM for ISGS.*° And an- 
other set of Fulani fighters also left al-Qa ‘ida’s ranks in the same 
general area not long after." 

Katiba Macina, specifically, has faced sharp internal debates be- 
tween local and non-local fighters over usage fees for access to lavish 
pastureland, zakat collection (or alms giving), and booty-sharing. 
These issues combined have caused a perception of marginalization 
among non-local fighters in the Inner Niger Delta, consequently 
spurring defections to the Islamic State.” 

While JNIM, through its silence on the clashes, may be trying to 
play down mounting tensions, ISGS has continued to try to poach 
JNIM combatants, undoubtedly antagonizing JNIM. 


Failed Attempts at Mitigating Tension 

Clashes erupted and intensified between JNIM and ISGS despite 
attempts by the two groups to work out agreements and establish 
deconfliction zones. For example, representatives from both JNIM 
and ISGS, facilitated by veteran al-Qa ‘ida leader Sedane Ag Hit- 
ta,°*ewho also serves as JNIM’s local military commander, report- 
edly met to discuss such issues in Boughessa in Mali’s Kidal region 
in February 2019."* Following the February summit, violent clash- 
es broke out between the jihadi camps that prompted at least two 
more meetings in June 2019"° and October 2019, with the latter 
taking place in the Tinzaouaténe area of Kidal, as documented by 
the United Nations." 


Future Outlook 
Notwithstanding the violent clashes between JNIM and ISGS, con- 
cern has grown about the threat the groups pose to the region. In 
July 2020, the U.N. monitoring team that tracks the global jihadi 
threat stated that “ISIL franchises in West Africa and the Sahel con- 
tinued to enjoy operational success in early 2020, as have those of 
Al-Qaida, heightening international concern about stability in the 
region.” “” Since 2017, both ISGS and JNIM have rapidly expanded 
across the Sahel.'** The two groups are pushing into new territory 
deeper in Burkina Faso, southwestern Niger, and southern Mali, 
while remaining a constant threat in central and northern Mali 
and western Niger.'*? JNIM’s constituent groups have penetrated 
deeper into Burkina Faso, now directly threatening the security of 
several West African states like the Ivory Coast, Benin, and Togo.’° 
In other areas, such as in eastern Burkina Faso, both JNIM and 
ISGS are controlling or contesting significant swaths of territory.’ 


ab The arguments were mainly between those fighters local to southern 
Mali and those regional fighters who came from areas outside of central 
Mali, not necessarily fighters from other countries. Local fighters have 
been given preference over their non-local counterparts, leading to the 
marginalization of the latter group of militants. 


ac Ag Hitta, also known as Abu Abdel Hakim al-Kidali (or “al-Qayrawani”), was 
the founder of AQIM’s Katibat Youssef ibn Tachfin in northern Mali. Despite 
leaving the jihadi ranks for a short period in 2013, he rejoined a few months 
later to continue to play a role in AQIM’s activities in the Sahel and now 
acts in a leadership role for JNIM. See Benjamin Roger, “Visuel interactif : 
le nouvel organigramme d’‘Aqmi,” Jeune Afrique, October 25, 2013; “Mali: 
ces Touaregs qui ont choisi le jihad,” RFl, May 22, 2015; and Menastream, 
“#Mali: Probably not seen before in the HOSINT domain, #JNIM military 
commander in ...,” Twitter, December 7, 2019. 


French military officials have posited ISGS as the biggest security 
threat in the Sahel.’ This is further indicated by significant French 
military action taken against the group relative to raids against 
JNIM." At the same time, however, U.S. officials have maintained 
that JNIM remains the most potent jihadi group in the region." 
The truth is likely somewhere in the middle. 

In early June 2020, al-Qa ‘ida in the Islamic Maghreb’s overall 
emir, Abdelmalek Droukdel, whom Iyad Ag Ghali and JNIM had 
the most immediate loyalty to, was killed in a French operation in 
northern Mali. The operation reportedly took place near the locality 
of Talhandak in Mali’s far north.’ His death was undoubtedly a 
major blow to al-Qa ‘ida’s overall efforts in North and West Africa 
given his long-standing role in al-Qa ‘ida’s international network.'° 
His death also represented a major loss to al-Qa ‘ida’s overall glob- 
al leadership, as the French Ministry of Defense has referred to 
Droukdel as the “third deputy” to al-Qa‘ida’s emir, Ayman al-Za- 
wahiri.!’ But it remains to be seen what effect, if any, Droukdel’s 
death may have on JNIM and its rivalry with ISGS. While JNIM 
had sworn bay ‘a (allegiance) to Droukdel, it is unclear how much 
control he wielded over JNIM’s day-to-day activities. It is also un- 
clear what role Droukdel played in the current fighting between 
JNIM and ISGS in the region.** 

This article has shown that the peaceful relationship in which 
JNIM and ISGS used to exist was the product of more than mere 
non-aggression: on various occasions, the two groups made clear 
and conscious efforts to cooperate on the ground. Owing to the 
complex nature of the Sahelian militant landscape, both JNIM 
and ISGS were able to leverage personal ties between various com- 
manders to facilitate this cooperation. But as both organizations 
have grown in the region, sources of tension, including notions of 
how to treat local populations and divergences in ideology, have 
caused this special relationship to sour. Disagreements over core 
issues gradually pushed the groups apart, overwhelmed personal 
relationships, and outmatched their shared objectives. The growing 
ambition of ISGS in this co-inhabited territory set the scene for a 
widespread turf war. 

But despite the ongoing battles in various parts of Mali and 
Burkina Faso, JNIM and ISGS are still apparently able to coexist 
in other areas of the Sahel, such as Mali’s Menaka region, most of 
Niger's Tillaberi region, and other parts of Burkina Faso, especial- 
ly in the Center-North. These areas have likely so far been saved 
from the violence between the two jihadi groups thanks to what 
the authors assess to be the particularly close ties between jihadis 
in both JNIM and ISGS there. But as this conflict continues, it is 
possible that these relative sanctuaries may also succumb to the 


ad While the circumstances around Droukdel’s presence in northern Mali 
remain unclear, some French media outlets reported that his arrival to the 
area was recent, while local Malian sources have stated that JNIM’s lyad Ag 
Ghaly had recently called for a meeting with Droukdel and other leaders. 
The topic of this purported meeting is unclear, though it is indeed heavily 
likely it was intended to address the current fighting between JNIM and 
ISGS and other situations across the Sahel. See Benjamin Roger and Farid 
Alilat, “Comment le chef d'Aqmi Abdelmalek Droukdel a été tué au Mali,” 
Jeune Afrique, June 6, 2020; Pierra Alonso, “Comment l'armée francaise a 
mené son raid contre le chef d’'Aqmi,” Libération, June 11, 2020; “Pourquoi la 
mort du chef d’Al-Qaida au Maghreb islamique est une étape importante,” 
L’Express, June 6, 2020; Alexandre Sulzer, “Aqmi : avec la mort de Droukdel, 
la France remporte une victoire mais pas la guerre,” Parisien, June 6, 2020; 
and Housseyne Ag Issa, “#Sahel #Mali. Une source trés proche de #JNIM 
confirme le meurtre de Droukdel ...,” Twitter, June 8, 2020. 
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intra-jihadi battles. 

The fighting between the two camps elsewhere stands to nega- 
tively impact the already perilous security situation in the Sahel by 
increasing the levels of violence. While some argue that fighting be- 
tween jihadi groups is positive for the counterterrorism landscape, 
it is also possible that the two groups are in effect engaging in a 
process called “outbidding,’ wherein a group aims to show “greater 
resolve to fight the enemy than rival groups.”** Some scholars have 
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A View from the CT Foxhole: Chris Costa, Former 
Special Assistant to the President and Senior 
Director for Counterterrorism 


By Seth Loertscher and Nick Kramer 


During the first year of the Trump administration, Colonel (Ret) 
Chris Costa was detailed to the White House as the Special Assistant 
to the President and Senior Director for Counterterrorism. Costa’s 
34-year government career included 25 years in counterintelligence, 
human intelligence, and with special operations forces (SOF) in the 
United States Army. He served in Central America, Europe, and 
throughout the Middle East and Afghanistan. He ran a wide range 
of intelligence and sensitive operations in Panama, Bosnia, Iraq, 
and Afghanistan. Colonel (Ret) Costa earned two Bronze Stars for 
sensitive human intelligence work in Afghanistan. Assigned to the 
Naval Special Warfare Development Group with Navy SEALs, he 
served as the first civilian squadron deputy director. In 2013, he 
was inducted into the United States Special Operations Command's 
Commando Hall of Honor for lifetime service to U.S. Special Op- 
erations. Colonel (Ret) Costa has been the executive director of the 
International Spy Museum in Washington, D.C., since 2018. 


CTC: You served as the Special Assistant to the President and 
Senior Director for Counterterrorism during the first year of 
President Donald Trump’s administration. Can you discuss 
what your team’s responsibilities were and where the team was 
situated within the NSC’s [National Security Council’s ] orga- 
nizational structure? 


Costa: First of all, I want to say that I inherited an extraordinary 
team of professionals, something I recognized before I even stepped 
into the NSC. Our mission was to provide options for the presi- 
dent of the United States as it related to counterterrorism (CT) 
and hostages. As the Senior Director for Counterterrorism, I was 
the convening authority for the Counterterrorism Security Group 
(CSG)—the body that pulls together the interagency, at the assistant 
secretary level, and develops options for the President for dealing 
with CT issues. These issues would come from our office—and the 
CSG—to deputies, to a principals committee, and, ultimately, to the 
president for consideration. 

My team was composed of 15 people at its highest point and 
consisted of professionals from across the interagency, including 
the FBI, State Department, Department of Justice, National Se- 
curity Agency, Central Intelligence Agency, the Department of De- 
fense (DoD), and the National Counterterrorism Center. I also had 
military officers that were detailed to the office from Army Special 
Operations and Naval Special Warfare. 

Our team was part of the broader NSC, which consisted of about 
12 other directorates, when I was there. Typically, the other direc- 
torates are either geographic or functional in focus, but ours was 
both. It was, essentially, a hybridization of the national security 
structure within our directorate and was responsible for providing 
options for the president across seven different priority areas. The 
first was protecting the homeland and overseas interests, including 


embassies. Two individuals on my team focused on identifying ter- 
rorist threats worldwide and mitigation strategies for those respec- 
tive threats, to include threats to commercial aviation. Additionally, 
I had a team that was focused on defeating ISIS, because, at that 
time, taking away the physical caliphate remained a significant pri- 
ority. To be clear, they were focused not just on Syria or Iraq, but 
also on the affiliates and branches of ISIS, which were developing 
and coalescing worldwide. The third priority for our directorate was 
continuing to focus on both core al-Qa ‘ida and but also al-Qaida 
affiliates, groups like al-Shabaab, al-Qa ‘ida in the Arabian Peninsu- 
la (AQAP), and Hay’at Tahir al-Sham.* We also recognized that we 
were going to put significant pressure on Iranian proxies. We were 
going to put pressure on Iran as a state, and we wanted to focus on 
Hezbollah. We recognized that it wouldn't be kinetic necessarily, 
but this was our fourth priority area. Fifth, we wanted to focus on 
countering terrorists’ use of the internet, which is also related to 
counter-radicalization. 

Another of our priorities was hostage recoveries and strategies. 
I was responsible for convening the Hostage Response Group 
(HRG), another interagency body, in concert with the Hostage [Re- 
covery | Fusion Cell, housed at the FBI, and the Office of the Special 
Presidential Envoy for Hostage Affairs at the Department of State. 
The hostages our team was concerned with were Americans held 
by terrorists, in addition to those held by countries that wouldn’t 
acknowledge holding U.S. citizens, like Iran holding Robert Levin- 
son, or Syria’s detention of Austin Tice, among others.” This was 
important because the unique tools of CT can be artfully employed 


a Editor’s note: Al-Qa‘ida’s Syrian affiliate Jabhat al-Nusra rebranded in July 
2016, taking the name Jabhat Fateh al-Sham and ostensibly dropping its 
links with al-Qa ‘ida. In January 2017, it merged with other groups, taking 
the name Hay’at Tahrir al-Sham. There is a debate among analysts about 
how close it remains to al-Qa ‘ida. In May 2018, the U.S. Department 
of State designated Hay’at Tahrir al-Sham an alias of Jabhat al-Nusra, 
essentially labeling the new group a Foreign Terrorist Organization 
(FTO). See Aymenn al-Tamimi, “The Formation of Hay’at Tahrir al-Sham 
and Wider Tensions in the Syrian Insurgency,’ CTC Sentinel 10:2 (2017) 
and “Amendments to the Terrorist Designations of al-Nusra Front,” U.S. 
Department of State, May 31, 2018. 


b_ Editor’s note: Robert Levinson, a former FBI agent, disappeared in Iran 
in 2007 while reportedly on a CIA operation and was suspected of being 
held by the Iranian government. In March 2020, it was revealed that he had 
died in captivity. Austin Tice, a freelance journalist, was detained in 2012 in 
Syria after being stopped at a checkpoint south of Damascus. The identity 
of his captors remains unclear, though in March 2020, President Trump 
appealed directly to the Assad regime for his release. See “For First Time, 
lran Says Case Is Open on Missing C.I.A. Consultant,” Associated Press, 
November 9, 2019; Adam Goldman, “Ex-F.B.1. Agent Who Vanished on C.I.A. 
Mission to Iran Is Most Likely Dead, U.S. Concludes,” New York Times, March 
25, 2020; Nisan Anmado, “Parents of US Reporter Missing for 7 Years in 
Syria Still Await His Return,” VOA News, November 14, 2019; Carol Morello, 
“Trump asks Syrian government to ‘work with us’ to free journalist who 
disappeared,” Washington Post, March 19, 2020. 


16 CTC SENTINEL JULY 2020 


COSTA 


to support recovery options. 

Lastly, we also focused on foreign fighters and terrorist detention 
issues. For instance, developing strategies for dealing with ISIS for- 
eign fighters who were being held by the Syrian Democratic Forces 
(SDF) and the future disposition of GITMO [Guantanamo Bay 
Detention Facility]. 

It was a relatively small team covering down on all those areas 
of concern. I think, though, our team was well equipped for two 
reasons. One, because I was extraordinarily lucky, just like my pre- 
decessors, to have a professional team of incredibly talented indi- 
viduals; and two, because their job was not to exclusively ‘own’ these 
issues but to work collaboratively with the interagency to generate 
and deliver appropriate policy options for the president—options 
that translated the overall strategy into policy and ‘operations, ex- 
ecuted by departments and agencies. My goal was to avoid ‘tactici- 
zation’ from the White House; I didn’t want us to be in the tactical 
fight. When we had to think about diplomatic options, we worked 
with the State Department. When we were considering military op- 
tions, we worked closely with the Pentagon. When thinking about 
the sanctions that we could employ and other financial tools, we 
worked with Treasury and State. Our job was to coordinate with 
the interagency to ensure that we had strategy and policy alignment 
and to make sure the interagency had consensus to the extent that 
we could. When we didn’t have consensus, we had to flag that to 
our leadership, which for me was the Homeland Security Advisor 
and the National Security Advisor. All this, I want to note, included 
constant engagements with our foreign partners. They wanted to 
know, what were we doing, how our policy options might impact 
South Asia, for example. What was our strategy going to look like 
when it was published? What was our position on Guantanamo 
Bay? We had to also engage with the diplomatic community in D.C. 
and our intelligence partners when they came to the NSC. All of that 
coordination happened, with regard to CT and hostages, with our 
12 to 15 people in the directorate. 

I also think that it’s important to highlight that we worked hard 
to keep politics out of the CT process. We recommended policy 
outputs that were well informed by sound intelligence. That’s one 
place where I had an advantage as a policymaker after all those 
years being an intelligence officer. I was well taken care of by the 
interagency and by the intelligence community. I knew who to talk 
to and what questions to ask. At the same time, I was well informed 
and I felt like I was on very firm ground when I made recommen- 
dations, which were informed by intelligence. 


CTC: What did the threat picture look like as your team took 
over in January 2017? 


Costa: At the end of 2016, and the beginning of 2017, there were 
attacks happening in Europe.” Some were ISIS-directed, complex 
attacks and some were ISIS-inspired, but it’s important to remem- 
ber that there were a dizzying number of attacks taking place in 
Europe. ISIS still controlled Raqqa, arguably their center of gravi- 
ty.’ There was a completely disrupted landscape from the Sahel to 
the Maghreb to the Horn of Africa, and from Afghanistan to the 
Philippines. ISIS was expanding outside Syria. There were affiliates 
and branches that were growing. We knew that we were going to 
have to accelerate our [counter-]ISIS campaign. 

With that background, I want to talk about what I call ‘day one, 
week one problems. The Monday after Inauguration Day, we had 


Chris Costa 


four significant issues within the directorate, day one, week one. 
First, we had to make a decision that first week on whether U.S. 
Special Operations Forces were going to conduct a raid against 
AQAP in Yemen.‘ Second, we had a persistent, pervasive, and dan- 
gerous threat to commercial aviation. We knew groups like AQAP 
wanted to bring down commercial airliners, and we knew, because 
there was continuity between the administrations, that this was a 
significant problem and we were going to have to handle it. It was 
not an easy problem, and it required complex policy decisions to 
mitigate that threat, along with actions that had to happen over- 


c Editor’s note: In late 2016, a raid was being considered to gather 
intelligence in order to “gather the information needed to map out [AQAP] 
and to prevent future foreign terrorist attacks.” The operation was initially 
planned under the Obama administration but, when its execution was 
delayed, was considered and approved by the Trump administration. The 
raid, conducted by U.S. Special Operations Forces (SOF) in January 2017, 
resulted in the deaths of one U.S. Navy SEAL, 14 AQAP operatives, and a 
number of civilians, including 8-year-old Nawar al-Awlaki, a U.S. citizen 
and the daughter of the previously killed AQAP leader Anwar al-Awlaki. See 
William M. Arkin, Ken Dilanian, and Robert Windrem, “Inside the Navy SEAL 
Raid in Yemen Targeting al Qaeda,” NBC News, February 2, 2017, and Terri 
Moon Cronk, “U.S. Raid in Yemen Garners Intelligence,’ DoD News, January 
30, 2017. 
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All of this was wrapped in, within the first week, the need to 
accelerate the campaign against ISIS.° As I mentioned, we did not 
want to manage that campaign from the White House, but we did 
see a need to accelerate the campaign and had to make sure the 
right tools and authorities were given to General [Joseph] Votel 
[then Commander of U.S. Central Command] in order to do that. 
The last issue that we were dealing with revolved around hostage 
recovery. We had hostages in Africa that we wanted to bring home, 
we had hostages in the Middle East that we wanted to bring home, 
and, of course, we had hostages in the Afghanistan-Pakistan border 
area that we wanted to bring home. Those were some of the prob- 
lems that we were dealing with just in the first week. 


CTC: What were some of the basic assumptions that under- 
pinned your effort to craft the framework for the Trump ad- 
ministration’s counterterrorism strategy? 


Costa: Going into the administration, I really hoped we would 
write the National Strategy for Counterterrorism (NSCT) during 
our first year, under my tenure. Ultimately, we didn’t do that, but 
what we did do was operationalize and test CT concepts. We were 
new as a team, so during that first year, we ended up framing the 
debates that the NSC and interagency would address. In the end, 
I’m glad we didn’t finish [the strategy] that first year, because I 
think the time we took to think through and debate the issues made 
it a better product. 

My first assumption walking in was that we could no longer fo- 
cus on just kinetic activities, although, to be clear, we had to spend 
a great deal of time that first year focused on direct action. If there 
was one major policy success my team had, in that first year, it was 
policy work on direct action.‘ I will say, however, that the flip side 
of that is that I recognized we couldn’t spend all of our effort on 
kinetic activities, so the strategy was going to have to focus on other 
instruments of national power. It was going to have to focus on stra- 
tegic communication and on different, innovate ways of countering 
radicalization and focusing on terrorism prevention. 


d_ Editor’s note: In March 2017, the U.S. Department of Homeland Security 
announced a ban on carrying select electronic devices onboard flights from 
several Middle Eastern and North African airports to the United States. 
This threat, described as “very sophisticated, real, and targeted at certain 
airports” by then Secretary of Homeland Security John Kelly, required 
coordination with intelligence agencies, DHS, and foreign countries to 
ensure the explosive devices could be detected. See Ewen MacAskill, 
“Laptop ban on planes came after plot to put explosives in iPad,” Guardian, 
March 26, 2017; John Kelly, comments at “Securing the Homeland in the 
Post-Post 9/11 Era,” moderated by Pete Williams, Aspen Institute, July 19, 
2017. 


e Editor's note: The U.S.-led campaign against the Islamic State began 
in 2014. President Donald Trump pushed to accelerate that campaign 
and the total destruction of the caliphate and organization. See Karen 
DeYoung, “Under Trump, gains against ISIS have ‘dramatically accelerated,” 
Washington Post, August 4, 2017, and “Trump to Explore Military Options for 
Defeating Islamic State,” Associated Press, January 27, 2017. 


f Editor's note: The U.S. government defines direct action as “lethal and non- 
lethal uses of force, including capture operations, against terrorist targets 
outside the United States and areas of active hostilities.” “Procedures for 
Approving Direct Action Against Terrorist Targets Located Outside the 
United States and Areas of Active Hostilities,” The White House, May 22, 
2013. 


The second assumption I had going in was that our approach to 
CT was going to be evolutionary and not revolutionary and that I 
needed to set expectations accordingly. I had to go to my bosses, look 
them in the eye, and say, “if there are big new ideas to win this fight, 
I do not know what they are.” [had to explain to them that there was 
going to be continuity between our approach to CT and previous 
administrations. We were going to build on lessons learned from 
pre-9/11, through 9/11, through post-9/11, and through my imme- 
diate predecessor [Jen Easterly ]. At times, my bosses, the National 
Security Advisor and the Homeland Security Advisor, were looking 
for something that was markedly different from what we had done 
in the past. I knew, though, that we had been successful, as a nation, 
in preventing another 9/11-scale attack, so while there were some 
ways that we could make the strategy different, it would also build 
on the success of the past. That was a very important assumption. 

Third, I knew, and my team knew, that we couldn’t go it alone. 
We were going to need a wide range of partnerships. We just can’t 
do CT independently; foreign partners are absolutely crucial. The 
fourth assumption was related to everything we've talked about so 
far; the threat landscape had changed. The Islamic State of Iraq and 
the Levant? [the Islamic State’s predecessor] was not mentioned 
in the 2011 National Strategy for Counterterrorism [the previous 
NSCT] because they did not exist yet, but it was very much focused 
on one jihadist-AQ-threat strain." Initially, I contemplated that we 
could stay focused on ISIS and perhaps publish an ISIS-specific 
strategy and then publish a broader CT strategy. I’m glad we didn’t 
go down that path. While the strategy took longer to publish, when 
it was published, it covered down on a greater array of threats and 
more accurately reflected the environment. If we tried to publish 
the strategy in the first year, we wouldn't have met the very objec- 
tives that I wanted to attain, so I give a lot of credit to the team that 
followed, because they did the hard work of getting the 2018 NSCT 
across the finish line. But, because we broadened the strategy, we 
ended up focusing on groups that we'd never talked about in our 
history of fighting terrorists, like white supremacists. 


CTC: You’ve mentioned in other forums that the 2018 Nation- 
al Strategy for Counterterrorism represented a “staying arc of 
continuity” between administrations, but also that you felt it is 
the “best [CT] strategy the nation has ever had.”* What aspects 
of CT policy were crucial to maintain across administrations, 
and what were some of the most important changes your team 
made? 


Costa: First and foremost, and this isn’t reflected in the CT strategy 
directly, but I inherited a great team and systems for addressing CT 


g Editor's note: The Islamic State in Iraq and the Levant (ISIL) was formed 
in April 2013, when Abu Bakr al-Baghdadi announced the merger of the 
Islamic State of lraq (previously al-Qa ‘ida in Iraq) with Jabhat al-Nusra, a 
decision that was not sanctioned by al-Qaida. This announcement led to 
a public rift between AQ and ISIL, ultimately leading to ISIL’s independence 
from al-Qaida. See Bryan Price, Daniel Milton, and Muhammad al-* Ubaydi, 
“The Islamic State in lraq and the Levant: More than Just a June Surprise,” 
CTC Sentinel 7:6 (2014). 


h_ Editor’s note: The 2011 National Strategy for Counterterrorism was written 
to outline “an approach that is more focused and specific” than previous 
strategies and claimed that the United States was “at war with a specific 
organization — al-Qa'ida.” See “National Strategy for Counterterrorism,” The 
White House, June 2011. 
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issues. The first thing I wanted to maintain was the CSG [Coun- 
terterrorism Security Group] process. I wanted to ensure that [the 
CSG] maintained its integrity and that there was continuity in how 
we approached CT problems as an interagency team. I also adopt- 
ed some of the human resource processes. These things might not 
sound important but I think they were for continuity. I could have 
made adjustments to the CSG process, for example, but it worked 
so efficiently and effectively I wanted to maintain that continuity 
so the actors within the interagency knew the mechanisms we'd be 
using to deal with CT issues. As far as my team, I wanted to ensure 
that we had nothing but professionals, who focused on the art and 
tools of the unique discipline that is CT. We genuinely needed to 
understand the multi-dimensional threat environment we were 
dealing with, and I wanted to maintain the professional ethos that 
included, among other things, how we used intelligence, no cher- 
ry-picking of intelligence, and no politicization of CT issues. As I 
mentioned before, I was really committed to the idea of evolution- 
ary, not revolutionary CT policy, and organizational continuity was 
an important part of that. 

We also had the chance to operationalize Presidential Policy Di- 
rective 30, the Obama administration’s reorganization of the U.S. 
government's hostage recovery enterprise. We brought home Cait- 
lin Coleman and her children after being in captivity for five years.' 
That’s a great example, in that first year, of continuity as we opera- 
tionalized the strategy and directives that were published. I think 
that’s some good news that the American public needs to know. 

Despite all the continuity, there were places we felt like the CT 
strategy needed to evolve. There were three important changes 
that grew out of the debates we had as we framed the issues and 
that the team subsequently built into the 2018 strategy. The first 
one was that we wanted to include domestic terrorism by white 
supremacists and we wanted a greater focus on state-sponsored 
terrorism, which included Iran. Arguably, we had never placed as 
much emphasis on state-sponsored terrorists before in a national 
CT strategy. We had primarily focused on al-Qa ‘ida. We had to 
include racially motivated violent extremists, which has become a 
term of art, but it gets to the heart of the far-right white suprem- 
acists that might employ violence. Take, for instance, the Russian 
Imperial Movement. That’s a great example of a white suprema- 
cist organization that has a nexus to overseas political violence and 
planning, and broadening the scope of the 2018 NSCT allowed the 
administration to take action against them. 

Second and related, as I already mentioned Iran, we wanted to 
focus more attention on proxies like Hezbollah, but not kinetically. 


i Editor’s note: Caitlin Coleman and her Canadian husband Joshua Boyle 
were kidnapped in 2012 and held for five years, probably by the Haqqani 
network, U.S. officials told Reuters. Caitlin and Joshua, along with three 
children born in captivity, were freed by Pakistani military forces. The New 
York Times reported U.S. officials urged Pakistan to carry out the operation 
after the family was located by a CIA drone in northwest Pakistan. See 
David Brunnstrom and Jonathan Landay, “CIA chief says U.S. Canadian 
couple held for five years in Pakistan,” Reuters, October 19, 2017, and Adam 
Goldman and Eric Schmitt, “Navy SEALs Were Ready if Pakistan Failed to 
Free Family Held as Hostages,” New York Times, October 17, 2017. 


j Editor's note: In April 2020, the U.S. Department of State designated 
the Russian Imperial Movement (RIM) as a Specially Designated Global 
Terrorist (SDGT) entity, making it the first white supremacist group to be 
designated as a terrorist organization by the United States. See Michael 
Pompeo, “United States Designates Russian Imperial Movement and 
Leaders as Global Terrorists,” U.S. Department of State, April 7, 2020. 


Our implementation strategy included putting pressure on Hez- 
bollah with sanctions, Rewards for Justice,‘ and other non-kinetic 
tools. From a CT standpoint, Hezbollah is cash starved right now 
and operating on a shoestring budget! This is a result not just of the 
strategy, but of actions taken during that first year, to expand focus 
on Hezbollah while still focusing on ISIS and al-Qa ‘ida. 

The third change was that we wanted to broaden our work on 
counter-radicalization. I inherited a term, “countering violent ex- 
tremism” (CVE), that we knew were going to get rid of because 
it was too politically charged. I came on board a believer that we 
had to do counter-radicalization work, unquestionably. But we also 
knew that we needed to get rid of that term and assess what the pre- 
vious administration did. The Department of Homeland Security, 
at the time it was [led by Secretary of Homeland Security] General 
(Ret) John Kelly, was going to assess those programs on CVE. While 
those assessments were taking place, we framed the argument that 
we needed to focus more on a prevention architecture, and that’s 
been institutionalized in the 2018 strategy.” That’s a very important 
point and its framing in the 2018 strategy contributed to the U.S. 
intelligence community and DHS trying to understand the nexus 
between right-wing extremists and foreign actors.° 


CTC: You mentioned wanting to broaden the administration’s 
work on counter-radicalization, but also said that a great deal 
of your time was taken up with the application of kinetic coun- 
terterrorism pressure against the Islamic State. What are the 
other non-kinetic tools that you think the United States should 
be investing in? 


Costa: We have to continue working on strategic communication 
and counter-messaging. The government is not going to solve all 
CT problems. NGOs and in some cases the private sector have to be 
involved with these programs. We instead have to rely on partners 
in countries like Jordan to counter malign jihadist messaging. King 


k_Editor’s note: Rewards for Justice is a Department of State 
counterterrorism program designed to “bring international terrorists to 
justice and prevent acts of international terrorism against U.S. persons or 
property.” The program provides monetary rewards for information that 
leads to the arrest of terrorist leaders, terrorists plotting attacks against 
U.S. persons, or that disrupts terrorist financing. See “Program Overview,” 
Rewards for Justice. 


| Editor’s note: The increase in non-kinetic U.S. government pressure against 
Hezbollah began in 2015 under the Obama administration with the passage 
of the Hizballah International Financing Prevention Act of 2015 and the 
designation of 21 Hezbollah-affiliated individuals as Specially Designated 
Global Terrorists in 2015 and 2016. Under the Trump administration, the 
pressure intensified through increased U.S. sanctions against lran and 
designations of the group's members and affiliated financial institutions. 
This pressure, described by Hezbollah’s leader, Hassan Nasrallah, as a 
“form of war,” has reportedly strained the group’s finances. See Seth 
Loertscher, Daniel Milton, Bryan Price, and Cynthia Loertscher, The 
Terrorist List: An Examination of the U.S. Government's Designation of 
Terrorist Groups and Individuals (West Point, NY: Combating Terrorism 
Center, forthcoming); Bassem Mroue, “US sanctions squeezing Iran- 
backed Hezbollah in Lebanon,” Associated Press, October 4, 2019; and 
Ben Hubbard, “Iran's Allies Feel the Pain of American Sanctions,” New York 
Times, March 28, 2019. 


m_ Editor’s note: The 2018 NSCT lists one of its priority actions as 
institutionalizing “a prevention architecture to thwart terrorism” under 
the “Counter Terrorist Radicalization and Recruitment" lines of effort. See 
“National Strategy for Counterterrorism of the United States of America,” 
The White House, October 2018. 
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Abdullah [of Jordan], for instance, has a private sector and civil so- 
ciety foreign partner forum to discuss the terrorism content on the 
internet.® Those are the kind of engagements we need to encourage. 

One project that I am personally involved as a private citizen 
now deals with former terrorists who have served their time in the 
U.S. prison system. We need to think about how we're going to en- 
gage with those individuals in the long term, after they're released. 
We're going to have some four hundred jihadists that have been 
prosecuted in the United States. In the next few years, scores of 
them are going to be released. I have interviewed Bryant Vifas, the 
first American post 9/11 to become a member of al-Qaida," and 
Najibullah Zazi, the would-be [New York City] subway bomber,’ to 
understand their path to radicalization, but also to leverage what 
they told me and get the word out on the false promises of waging 
violent jihad, either via podcasts or in published articles.’ It is really 
important to chip away at jihadist messaging—so letting terrorists, 
former terrorists, in their own voice, counter that messaging. These 
are things that I want to see more energy focused on in the future. 

To the point about being so focused on kinetic targeting, I did 
come into the administration hopeful that we could focus more on 
counter-radicalization. But given the problems that we had, our 
priority first was taking away ISIS’ physical caliphate. But even that, 
in essence, is an important strategic message, that ISIS lost their 
so-called caliphate. In doing that, you're taking away an important 
message from ISIS themselves. 


CTC: Partnership with the Syrian Democratic Forces has been 
important for U.S. efforts to defeat the Islamic State. Some have 
argued that this type of “surrogate warfare” will continue to 
be employed as states seek to pursue national interests in an 
increasing complex 21st century security landscape.* Why was 
the decision to work with a partner force so central to the “de- 
feat ISIS” campaign? 


Costa: The first point is that the U.S. is moving away from large- 
scale deployments. I don’t think this president, in particular, will 
support large deployments of the U.S. military, and I think his sen- 
sibilities are right. Americans do not want endless wars. So, in cases 
where the U.S. national interests dictate kinetic action, the conflicts 
will require surrogates. 

Secondly, the United States can’t solve every problem. It’s not 
going to be the U.S. providing whatever comes in the aftermath of 
amore settled Syria or Iraq. These issues are long-term, and when 


n_ Editor's note: Bryant Vifias was the first American to be recruited into 
al-Qaida after 9/11. He was captured and eventually turned on the group. 
See Mitchell Silber and Bryant Vifias, “Al-Qa‘ida’s First American Foreign 
Fighter after 9/11,” CTC Sentine! 11:8 (2018). 


o Editor's note: Najibullah Zazi traveled to Pakistan to join the Taliban and 
while there was convinced by al-Qa‘ida to conduct attacks in the United 
States. In 2009, he and others planned an attack on the New York subway 
system, but Zazi was arrested after the plot was discovered. He has since 
cooperated with the U.S. government. In September 2019, CNN reported 
that Zazi had been released from jail after serving his 10-year sentence. See 
Emily Saul and Laura Italiano, “Would-be NYC subway bomber Najibullah 
Zazi to be released on time served,” New York Post, May 2, 2019, and Erica 
Orden, “Najibullah Zazi, who plotted to bomb the New York subway, gets a 
second chance,” CNN, September 28, 2019. For more on the plot, see “Al 
Qaeda Operative Convicted by Jury in One of the Most Serious Terrorist 
Plots Against America since 9/11,” U.S. Department of Justice, March 1, 
2012. 


CT operations happen, they will likely be executed with a small U.S. 
footprint and partner forces, which I think is consistent with the 
goal of having less U.S. troops deployed. 

The third point is that these discrete CT campaigns, what I 
call wars within wars, are part of broader non-kinetic fights for 
influence that some refer to as grey zone conflict.° It took a year 
at the NSC to fully process and recognize that. There are whole 
other dimensions, aside from the CT fight. There were dangerous 
political faultlines; Iranians were in the battlespace, Russia was on 
the ground, Israel had significant concerns with Hezbollah. Syria 
was certainly operating inimical to U.S. interests, plus they held 
American hostages. The president also had to worry about Turkey, 
and at the same time, we had to balance not having a precipitous 
withdrawal. That isn’t an environment where large deployments of 
U.S. forces are going to be useful. It’s instructive to look at what we 
were authorized to do. We were authorized to work with partners, 
to give the SDF the equipment they needed to ramp up their efforts 
in Raqqa."® This NSC, however, did not focus on the day-to-day 
tactical fight, but rather on monitoring the grey zone conflict that 
was playing out and to ensure that we were postured to keep pres- 
sure on ISIS. Now, I’m happy to say that there remains a small U.S. 
footprint on the ground in Syria. 


CTC: What were some of the challenges of trying to work 
through a partner force to achieve such an important U.S. pri- 
ority? How did you mitigate those challenges? 


Costa: There are a number of challenges working through partner 
forces, and it’s easy to get caught up in the tactical challenges of 
those partnerships. We had trust, however, that General Votel [then 
CENTCOM Commander] and General Dunford [then Chairman 
of the Joint Chiefs of Staff] were handling those challenges with 
regional partners. They were engaged with the SDF, with the Kurds 
in particular, and were engaging with the Turkish military and had 
open lines of communication with the coalition against ISIS. As all 
of that was playing out, our job at the NSC was to oversee regional 
security, to ensure lines of communication with partners remained 
open, and to focus on the broader geopolitical issues. It can be hard 
to maintain that high-level focus with CT, which often looks incred- 
ibly tactical. 

One challenge in particular was the regional implications of 
arming our partner force, the SDF, which was heavily Kurdish. We 
knew, obviously, that Turkey would be disturbed by that, so we had 
to carefully generate options for the president to consider what type 
of support we would provide. What type of equipment, what type 
of weapons, what type of ammunition? We had to generate policy 
options that would allow the SDF to conduct operations to defeat 
the Islamic State, yet also not create undue regional tension. Ulti- 
mately, the president was going to sign off on equipping the SDF, 
so it became important to develop a plan to communicate that to 
our regional partners, Turkey especially." Those were the types of 
problems, in concert with the interagency, that our directorate had 
to work on. 


CTC: How do you think about the balance between risk, politi- 
cal and strategic, and providing latitude for military command- 
ers to pursue a campaign that allows for maximum initiative? 
Special operations forces are designed to shape the strategic 
environment, so how do you hedge against decisions or failures 
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that can have significant strategic implications while keeping 
tactical decision-making out of the National Security Council? 


Costa: We had to deal with that in the first week with the raid 
against AQAP. I was responsible for having discussions with the 
National Security Advisor, and other deputies and decisionmakers, 
while the planning was playing out. President Obama made a con- 
certed effort, evidently, not to make the final decision to authorize 
the operation against AQAP because it was unfair for it to play out 
in the middle of a transition, literally around Inauguration Day. 
We understood that we inherited an operational plan that the new 
administration had to decide on.” 

All of that said, I did what I had learned cumulatively over a 
career. First, I received the operational plan at a macro level. I’ve 
made points previously about eschewing the tactical aspects of op- 
erations at the NSC, but in this case, as a policymaker, I needed to 
better understand the overarching plan so I could contemplate the 
risks. Second, once I understood the broad contours of the opera- 
tion, I was prepared to discuss those risks with the National Secu- 
rity Advisor so he could lay it all out for the president. 

Third, I understood my role if something went awry. When I was 
woken up by a call from the Situation Room in the early hours of 
the morning, I made my way into the White House and called my 
counterparts at the Pentagon and simply asked them if there was 
anything they needed from my office. Ifnot, I wanted them to know 
I'd be there for the rest of that Sunday. If they needed to call me, 
needed me to push any information to the president through my 
chain, I was there. What I didn’t do was ask for constant updates; I 
didn’t insert myself. I wanted them to do the appropriate notifica- 
tions. I wanted them to assess the intelligence that was taken from 
their sensitive site exploitation on the ground in Yemen. I had to 
focus on other strategic issues. What were the implications of this 
with the Yemeni government? Would the United States still be able 
to conduct operations on the Arabian Peninsula? What other im- 
pact would this operation have in the region? These are the things 
I had to focus on, and it was difficult to do, it was gut-wrenching. 
I remembered Ryan Owens [the U.S. Navy SEAL killed]; I knew 
others who were there on the ground. There is a human dynamic 
to policy decisions. 

I think that operation, how we handled it, set the tone for our 
partners in the interagency because we trusted them to do their jobs 
and didn’t ask them to push us a lot of data. How do you strike the 
balance between understanding the risk without squashing initia- 
tive? I think you arm yourself with as much information as you need 
to be cleareyed about the risk, ensure you communicate that risk, 
and once a decision is made, support the organizations responsible 
for the operation. I think it was the cumulative years of managing 
and mitigating risk that allowed me to do that. 


CTC: One of the debates in counterterrorism revolves around 
how much of a CT policy to make public.” In implementing its 
CT strategy, the current administration has reduced some of 
the reporting requirements for counterterrorism operations." 
As someone who has had experience in both classified, com- 
partmentalized units and, now, in a public-facing organization, 
what do you think the right balance is between secrecy and 
transparency in CT policy and operations? 


Costa: When we wrote the National Counterterrorism Strategy, we 


wrote it for multiple audiences. We're writing to our adversaries, 
were communicating to our strategic partners, and, of course, we 
are writing to the American public. We all unquestionably decid- 
ed that the CT strategy needed to be a public-facing document, to 
provide its trajectory and share the president’s CT strategy for the 
nation. At the same time, however, we all recognized that some of 
the work would not be made available to the public because of clas- 
sification. The question becomes, how do you strike the balance 
of secrecy and transparency? I think every administration does it 
differently, and we recognized a need to be more opaque on some 
details than the previous administration.” We decided we did not 
want to communicate our techniques and procedures for how we 
conduct direct action, for example. We did not want to ‘telegraph 
our punches to our adversaries. Some argued that our foreign part- 
ners would insist on seeing the details and that our strategic rela- 
tionships could suffer, but those concerns were overblown. 

The American public generally does not want to know the details 
of direct-action work. What they should know is that it’s working 
well and that the U.S. is not dismissing our obligations for pro- 
portionality and protecting non-combatants. I can’t speak to the 
reporting of civilian casualties, but I will tell you that the direct-ac- 
tion policy is a sound policy. We have significantly streamlined the 
process. The policy overall is effective and efficient. 


CTC: There have been a number of recent developments that 
have reduced the pressure the Islamic State is feeling, with a 
metrics study published in the May 2020 issue of CTC Sentinel 
finding that the group has “recovered from its territorial de- 
feats since 2017” and is mounting “a strong and sustained re- 
surgence as an insurgent force inside Iraq.”"* How do you think 
about the threat from the Islamic State over the next few years? 


Costa: I am cautiously optimistic that we have taken away the 
message of the caliphate, by that I mean that we've destroyed the 
physical caliphate, which has taken away one of the group’s main 
messaging narratives. At the same time, however, I am absolutely 
confident that some group, whether an offshoot from ISIS or some 
other group, will emerge out of the ashes. That’s what happened 
with al-Qa ‘ida in Iraq when we pulled our forces out [in 2011], 
which I think was done precipitously. So, we must consider that 
there will be some resurgent group that organizes clandestinely 
and builds on the work that ISIS did. Terrorism is not going to go 
away. It sounds cliché, but this is a generational fight and we can 
never declare the mission completely accomplished, which is why 
it’s more like the metaphor of a disease. It is not going to go away, 
but we can treat it, we can focus on it. But at the end of the day, it 
is going to continue. 

We can enjoy partial success, on some level, in the fact that what- 
ever group emerges is likely to be more localized. It will be a pri- 


p_ Editor’s note: In May 2013, President Obama approved a presidential policy 
guidance on direct action and laid out the basics of his administration’s 
counterterrorism framework during a speech at the National Defense 
University. The presidential policy guidance on the use of direct action 
in counterterrorism operations was declassified and published in 2016, 
preempting a court order requiring the guidance be made available for 
review in a Freedom of Information suit brought by the American Civil 
Liberties Union. See “Remarks by the President at the National Defense 
University,” The White House, May 23, 2013, and Josh Gerstein, “Obama 
releases drone strike ‘playbook,” Politico, August 6, 2016. 
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marily regional issue. That’s where we are going to have to rely on 
foreign partners, like the government of Iraq. They'll have seen this 
cycle before and understand what happened when they did not nip 
a burgeoning ISIS in the bud. Look at Mosul in 2014, for instance. 
This is where it goes full circle and where we're going to have to 
redouble our efforts to work with foreign partners. We're also going 
to have to maintain HUMINT capabilities, meaning networks of 
sources reporting on the ground. Our SOF forces and other intelli- 
gence agencies will have to continue to develop sources and be the 
connective tissue with the right actors on the ground. 

Of course, we have to balance all of that with other intelligence 
problems, such as the [COVID-19 ] pandemic, dealing with a China 
that is acting more threatening than they have historically, and a 
Russia that will continue to test us. But we're a great nation and we 
can do more than one thing at a time. 


CTC: The shift toward near-peer competition as exemplified in 
the 2018 National Defense Strategy has led to funding, policy 
attention, and resources flowing away from counterterrorism, 
both in the military and intelligence agencies. Additionally, 
the COVID-19 crisis may put further pressure on counterter- 
rorism budgets because of the bleak economic outlook and the 
overwhelming need to tackle the current global public health 
emergency.’° Given these new parameters, how do you think 
counterterrorism operations and focus will change over the 
next several years to support the pivot to near-peer competition 
as CT forces operate in a constrained environment while still 
meeting the threats from terrorism actors you’ve discussed? 


Costa: In short, the bottom line is there are going to be some bud- 
get cuts, there will be some reapportioning of resources. That’s just 
natural in light of a pandemic, North Korea, and other priorities. 
At the same time, however, we are at a greater risk of overcorrecting 
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on the CT front. People have argued that there is a “terrorism trap” 
with people like me saying “if you take away our resources there is 
going to be a 9/11.” Conversely, here’s what I actually argue: There 
hasn't been another 9/11. There have been attacks, but for all intents 
and purposes, we've been successful at preventing another attack on 
that scale. If what we have built works, and it’s not broken, then we 
should continue, at a consistent level, with how we have operated, 
because it has protected the nation. Yes, some resources might need 
to be reapportioned. There might be more fat that can be cut from 
the CT budget, but I think the greater risk is overcorrection. And 
the CT enterprise works. The National Counterterrorism Center 
works. Small-footprint SOF operations, working with local part- 
ners, working with foreign partners, these things work. HUMINT, 
as well, is important and, relatively speaking, is inexpensive. I think 
it’s important to identify and reinforce the successes we've had in 
the CT sphere. 

The other point I'd like to make is that everywhere I went, from 
France to Israel to Jordan to the Palestinian Authority, in all those 
places CT is a currency. Everyone wanted to talk about it. It’s im- 
portant even to countries that are not always happy with our broad- 
er foreign policy. It evens the playing field, so to speak. Virtually all 
nations worry about vulnerabilities to terrorist attacks. Whether 
from violent right-wing extremists, violent left-wing extremists, or 
something in between, everyone worries about violent extremists 
and terrorism. 

All of that said, I think we can do both CT and rebalance for oth- 
er threats at the same time. Our nation has tremendous resources. 
I think the answer is working with foreign partners; focusing on 
our robust intelligence capabilities, HUMINT in particular; and 
leveraging our special operations forces. Our rebalancing can’t be 
binary; it can’t be an either/or proposition. We can’t, for instance, 
focus on North Korea or China and forget about CT. We're going to 
have to figure out a way of doing both. CTC 
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The Threat from Europe's Jihadi Prisoners 


and Prison Leavers 
By Robin Simcox and Hannah Stuart 


Two databases maintained by the authors shed light on the 
nature and scale of the threat posed by jihadi prisoners and 
prison leavers. Drawing from a database on terror activity 
in Europe, a new qualitative analysis of 12 alleged terrorist 
plots or attacks in Europe involving jihadi prisoners and 
prison leavers helps explain the nature of the threat, find- 
ing that both those thwarted in their attempts to partici- 
pate in foreign terrorist fighting and those who returned 
from actually doing so were—from this limited sample— 
commonly involved in such attacks. This often manifested 
itself in specifically targeting the police or prison guards. 
There was no typical timeframe for terrorist reengage- 
ment or recidivism. Where the data was available, average 
time lag was three years, nine months and the median was 
two years, six months. A comprehensive second dataset of 
Islamist terrorism convictions and attacks in the United 
Kingdom between the beginning of 1998 and the end of 
2015 provides a quantitative case study into recidivism and 
reengagement. New calculations by the authors support 
recent findings pertaining to Belgium by Thomas Renard 
by finding terrorist recidivism among U.K. offenders who 
are convicted of multiple terrorism offenses on separate 
occasions is low. However, if individuals who had a prior 
criminal record for criminal behavior interpreted as ex- 
tremism-related but not terrorism-related are included, 
the rate of recidivism posed by jihadi prisoners/prison 
leavers—and subsequent scale of the threat—is apprecia- 
bly higher. 


n December 2018, Gilles de Kerchove, the European Union’s 

Counter-Terrorism Coordinator, declared “prison leavers” to 

be the third-most serious threat Europe faced from Islamist 

terrorism. (Homegrown radicalization and returning for- 

eign fighters were one and two, respectively.)! Two incidents 

in the United Kingdom in recent months bore out de Kerchove’s 
concerns. 

In November 2019, Usman Khan stabbed two people to death 

and injured three others during a terrorist attack in and outside 

Fishmonger’s Hall overlooking London Bridge in central London. 


Robin Simcowx is Director of the Counter Extremism Group, based 
in London. Follow @RobinSimcox 


Hannah Stuart is Director of Research at the Counter Extremism 
Group. Follow @HannahmStuart 


Khan’s attack was disrupted by nearby civilians before he was shot 
and killed by the police. In February 2012, Khan had been con- 
victed over a plan to travel to Kashmir to establish a training camp 
that would produce terrorists to carry out attacks there, with the 
possibility of returning to carry out future attacks in the United 
Kingdom. The broader cell he was part of—which was arrested in 
December 2010—had proposed attacking the London Stock Ex- 
change.” 

Then, in February 2020, Sudesh Amman stabbed two civilians 
in Streatham, south London, before being shot and killed by the 
authorities. Amman had previously pleaded guilty in November 
2018 to both possession and dissemination of terrorism-related 
documents.* 

Similar incidents will inevitably arise in the future. According 
to a United Nations Security Council report, “[a]s many as 1,000 
foreign terrorist fighters imprisoned on return to Europe prior to 
2015 are expected to be released in Europe in 2020." This figure 
does not even factor in those jailed across Europe for terrorism of- 
fenses not related to foreign fighting who will also be released this 
year. Furthermore, a July 2020 study by the Center for the Analysis 
of Terrorism (CAT) in Paris found that 60% of those who left France 
to fight jihad in Afghanistan, Bosnia, or Iraq between 1986 and 
2011 went on to commit a fresh terrorist offense upon their return.® 

Yet in a recent study on terrorist recidivism? in this publica- 
tion, Thomas Renard stated that some of the public discourse on 
the threat was “overblown,” arguing that “Khan and Amman are 
more likely to be eye-catching outliers than a harbinger of things 
to come.’ Renard’s analysis demonstrated that when looking at ter- 
rorist recidivism and reengagement statistics in Belgium between 


a_ Such attacks have led to significant debate within the United Kingdom 
on terrorist reengagement, recidivism, and prison radicalization. One 
manifestation of this was the January 2020 announcement of a joint Home 
Office and Ministry of Justice review of the Multi Agency Public Protection 
Arrangements (MAPPA) designed to supervise released terrorism and 
terrorism-related offenders. Another was the scrapping of automatic 
release for terrorists serving fixed sentences. The Terrorist Offenders 
(Restriction of Early Release) Act 2020 was passed by the U.K. Parliament 
in February 2020, meaning that offenders who receive determinate 
sentences for relevant terrorism-related offenses—as well as existing 
prisoners—are no longer released automatically at the halfway point and 
must appear instead before the Parole Board at the two-thirds point. The 
government fast-tracked the legislation in the wake of the Streatham 
attack, in part because of concerns about terrorist offenders due for 
automatic release that month. See Terrorist Offenders (Restriction of Early 
Release) Bill 2019-2020, House of Commons Library Briefing Paper No. 
8821, February 11, 2020. 


b Renard defined terrorist recidivism as “two convictions for distinct 
terrorist offenses over distinct periods of time, separated by a clear period 
of disengagement (commonly imprisonment).” In this article, terrorist 
recidivism is understood as individuals who are convicted on two separate 
occasions for at least one terrorist offense each time. 
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1990-2019, less than 5% of convicted terrorists returned to terror- 
ist activity. However, as Renard also acknowledged, “even a small 
number of recidivists can still constitute a most serious threat in the 
short- to longer-term.” 

This article seeks to broaden Renard’s assessment of the threat 
picture in Belgium. 

In part one, it presents case studies from across Europe of indi- 
viduals previously convicted of terrorism offenses who subsequently 
go on to plan or carry out a terrorist attack after a period of disen- 
gagement, typically imprisonment, both after and prior to release. 
The authors acknowledge that data for this section is not exhaus- 
tive. Therefore, part one of this study seeks to present a qualitative 
analysis on the nature of the terrorist threat posed by prisoners and 
prison leavers, not an overall sense of the scale. 

The article uses open-source material to provide key details 
about the attacks or alleged plots, including where they took place 
geographically and whether they were committed by those who had 
left prison or those who were plotting while still incarcerated. 

It then looks at the geographic scope of previous terror activity 
by the individuals included in this study as well as which of them 
had previous convictions pertaining to either foreign terrorist fight- 
ing or being ‘frustrated travelers’ who were unsuccessful in their 
attempts to access a conflict zone. 

This analysis then explores the individuals’ trajectory of offense, 
examining whether their initial offense involved the intent of vio- 
lence, as well as the timespan for reengagement between this initial 
offense and the actual alleged plot or attack. 

It goes on to assess whether the individuals profiled in this study 
had declared an allegiance to a foreign terrorist organization; the 
extent to which—if at all—they were under surveillance by author- 
ities at the time of their alleged plot or attack; and questions raised 
by the management of terror offenders, including the effectiveness 
of rehabilitation and reintegration efforts. 

Part two of the article uses an additional, comprehensive dataset 
of Islamist terrorism convictions and attacks in the United King- 
dom between the beginning of 1998 and the end of 2015, which was 
previously compiled by one of the authors, to provide a quantitative, 
country-specific case study of the extent to which broader recidi- 
vism and reengagement by convicted terrorists is common. There- 
fore, this section is more concerned with the scale of the threat 
this cohort poses. The terrorist recidivism rate for all U.K.-based 
Islamist terrorism convictions and attacks during this timeframe 
is calculated. The article also provides an assessment of how those 
previously convicted of terrorist activity both in the United King- 
dom and overseas, and terrorist offenses carried out by individuals 
with previous convictions interpreted as extremism-related, are 
relevant to the recidivism threat picture. 


Part One: What 12 European Terror Cases Reveal 
about the Nature of the Prisoner Threat 

This section provides qualitative data on 12 alleged jihadi terrorist 
plots/attacks that helps demonstrate the nature of the threat from 
jihadi prisoners and prison leavers in Europe. 


Inclusion Criteria 

This study analyses 12 alleged jihadi terrorist plots/attacks* that 
occurred in Western Europe between January 2014 and April 2020 
in which at least one of the alleged plotters/attackers had been 
convicted in Europe of a previous terrorism-related offense.‘ This 
includes individuals killed during their attack as well as those con- 
victed of—or awaiting trial for—planning an attack. These plots/ 
attacks were extracted from a personal database of over 300 plots 
in Europe maintained by one of the authors.° 

As the purpose of this database was to track the threat to Europe 
following the rise of the Islamic State, January 2014 was chosen as 
the starting point. Therefore, the database includes Islamist attacks 
that took place since that date; thwarted plots that led to convic- 
tions of those planning attacks in Europe; arrests of those suspected 
of planning attacks;‘those assessed to be planning attacks who were 
subsequently deported on national security grounds; and a small 
number of incidents where a demonstrable Islamic State inspira- 
tion led to the targeting of different faiths, religious sects, and/or 
practices. To qualify for inclusion in this database, the violent act 
had to be focused on targets in Europe itself, as opposed to, for 
example, a plot targeting European embassies in the Middle East 
or Africa. 

This database was compiled using open-source material. While 
the author attempted to be exhaustive, this data is unlikely to be so 
as there was neither the resources nor the language skills to moni- 
tor all terror cases across Europe. Furthermore, there will be cases 
where the sensitivity of how the intelligence was gathered means 
that terror suspects were never brought to trial and, subsequently, 
received no media coverage. Difficulties surrounding the catego- 
rization of violent incidents involving Islamists in prison may also 
mean there were incidents with potential terrorist intent that were 
not considered such by certain governments and therefore may be 
less likely to receive media attention. Therefore, this study is not ex- 
haustive: there have potentially been more plots/attacks since 2014 
involving individuals previously convicted of terrorism offenses. 

While all individuals included in this study have planned, or al- 


c Inusing the formulation “alleged plots/attacks” in this article, the authors 
are referring to (1) actual terrorist attacks and (2) terrorist attack plots 
(alleged or proven in court) that did not result in attacks. 


d_ The broader dataset (from which this study is built) starts from January 
2014, and so this article only considers cases in which the second offense 
occurred after this date. Pre-2014 examples across Europe of an individual 
convicted of a terrorism-related offense and then planning a terrorist 
attack, either after or prior to release from prison, are not covered by this 
study. The study excludes Russia. 


e The theme of jihadi recidivism outside Europe has also been explored by 
scholars. For an analysis of this phenomenon in the United States, see 
Christopher Wright, “An Examination of Jihadi Recidivism Rates in the 
United States,” CTC Sentinel! 12:10 (2019). 


f If these allegations are shown to be unfounded, or lead to acquittals in 
court, the individuals in question are subsequently removed from the 
dataset. For example, a Syrian refugee called Hasan A. was included in 
the dataset upon his January 2017 arrest, as German authorities had 
discovered he was attempting to acquire money from the Islamic State in 
order to—Hasan A. told the Islamic State—carry out a series of bombings in 
Germany. At trial, however, it emerged that he had no intention of carrying 
out an attack and was actually trying to defraud the terrorist group. 

Hasan A. was subsequently removed from the dataset. See “Court finds 
defrauding Islamic State is a crime in Germany,’ Reuters, August 14, 2017. 
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legedly planned, a distinct act of terrorist violence—either inside® or 
outside of prison—from January 2014 onward, the offense that led 
to that individual being incarcerated for the first offense occasional- 
ly occurred before 2014. The authors did not set a time limit regard- 
ing the date of the first offense, but the earliest arrest for terrorist 
activity among those profiled was 2003. The cut-off point for the 
second offense was April 30, 2020. 

The study only looks at alleged jihadi terrorist plots/attacks in- 
volving individuals previously convicted in a civilian court in Eu- 
rope of at least one terrorism related offense before being involved 
in a plot (alleged or otherwise) or attack in Western Europe. These 
criteria therefore excluded individuals convicted of a second ter- 
rorism offense that was not related to attack planning, for example, 
fundraising for terrorist purposes or possession of terrorist material. 
They also excluded the likes of Osamah Abed Mohammed, who was 
convicted in Zurich in March 2016 as part of an Islamic State-in- 
spired Iraqi cell planning attacks in Switzerland.’ Mohammed was 
suspected of having previously been detained by U.S. forces in Iraq, 
after admitting to carrying out attacks on coalition forces.’ Howev- 
er, these suspicions were never tested in a European court. 

The authors have chosen to focus, therefore, on a narrowly de- 
fined subset of terrorist reengagement. The cases are limited to 
planned or actual terrorist attacks involving Islamist extremists 
who had previously been convicted—and imprisoned—for a ter- 
rorism-related offense. 

This approach led to a small sample size limited to 12 alleged 
plots/attacks. (See Table 1.) While this is a limitation to the study, 
it also enables a closer look at certain cases that have been of high 
concern to the security services and about which the press and the 
public have asked politicians what more could have been done to 
prevent their occurrence. 


The Findings 

The 12 alleged plots/attacks studied took place in three separate 
countries: France (eight cases), the United Kingdom (three cases), 
and Germany (one case). Three attacks resulted in deaths (two at- 
tacks in France, one attack in the United Kingdom) and six attacks 
resulted in injuries (three attacks in France, two attacks in the Unit- 
ed Kingdom, one attack in Germany). The remaining three plots 
were foiled, meaning there were no casualties. 

Therefore, of the 12 alleged plots/attacks studied, there were 
victim casualties (either injuries or deaths) in nine incidents. In 
total, terrorists were responsible for 16 deaths and 28 injuries in 
these nine plots. The other three plots were thwarted by security 
services or the police. 

While nine of 12 alleged plots/attacks leading to victims is a high 
percentage, as this study is not exhaustive, it should not be assumed 
that this is reflective of the overall likelihood that plots carried out 
by recidivists or those reengaging are likely to be successful. 

Eight plots involved individuals who either acted alone or 
were arrested alongside others against whom charges were either 


g Asnoted later in the article, what constitutes a terrorist attack inside a 
prison warrants careful consideration. 


h_ These are the three European countries that, according to one of the 
author's database, have been most commonly targeted by Islamist 
terrorists. See Robin Simcox, “European Islamist Plots and Attacks Since 
2014—and How the U.S. Can Help Prevent Them,” Heritage Foundation 
Backgrounder No. 3236 (2017). 


dropped or charges of planning a specific act of terrorism in Europe 
were not pursued.’ Four plots involved multiple perpetrators, some 
of whom had a prior (non-terrorist) criminal record. 

These 12 alleged plots/attacks involved 20 Europe-based indi- 
viduals (i.e., the attacker, or an individual currently facing charges 
in relation to a plot). Of those, 13 had previously been convicted in 
Europe of terrorist activity. That meant there was only one alleged 
plot in the dataset in which individuals previously convicted of ter- 
rorism activity together.‘ 

All 13 were male. 


Prison Leavers 

Seven alleged plots/attacks were committed by at least one individ- 
ual who had been released from detention (four in France, two in 
the United Kingdom, one in Germany). 

The highest-casualty attack committed by those in this study was 
the attack on the Charlie Hebdo offices in January 2015, which led 
to 12 deaths and 11 injuries. One of the perpetrators, Cherif Koua- 
chi, had previously been convicted of a terrorism-related offense in 
France.” Kouachi had been arrested in January 2005 as he prepared 
to leave the country and head to Iraq to take part in the fighting 
there.° According to the French prosecutor in the case, Jean-Julien 
Xavier-Rolai, the ‘19" arrondissement cell’ that Kouachi was part of 
in Paris at the time had sent approximately a dozen individuals to 
Iraq to join up with Abu Musab al-Zarqawi, the emir of al-Qa ‘ida 
in Iraq.”° 

While awaiting trial, Kouachi spent one year and eight months 
in prison and was then released under judicial supervision. When 
convicted at a 2008 trial, he was sentenced to three years but was 
immediately freed due to time served." 

Most prison leavers either carried out or planned to carry out 
their attacks alone. In the United Kingdom, Usman Khan and 


i The eight alleged plots/attacks in question involved Rafik Mohamad 
Yousef (Germany); Youssef Ettaoujar, Larossi Abballa, Bilal Taghi, Christian 
Ganczarski, and Mohammed Taha El Hannouni (France); and Usman Khan 
and Sudesh Amman (United Kingdom). 


j The four alleged plots/attacks in question relate to Cherif Kouachi, who 
plotted alongside Said Kouachi (see “Charlie Hebdo attack: Three days of 
terror,’ BBC, January 14, 2015); Mohamed Chakrar, who allegedly plotted 
alongside Alexandre Benon, Karim Bendjeghal, Anis Mesroua, and Khamid 
Sidiev (see “Attack foiled against the Elysee Palace: a fifth suspect arrested 
in Strasbourg,” Parisien, May 7, 2019); Zoubeir C. and Matthieu C., who 
allegedly plotted alongside Sylvain D. (see Jérémie Pham-Lé, “In prison, 
detainees suspected of planning attacks in France,” Parisien, July 31, 2019); 
and Brusthom Ziamani, who plotted alongside Baz Macaulay Hockton (see 
“HMP Whitemoor prison officer attack: Inmates in court,” BBC, March 4, 
2020). 


k Allegedly, Ziamaini’s attack also involved another prisoner, Baz Macaulay 
Hockton, who was in jail for committing a violent offense but—as Hockton 
is not listed on the Crown Prosecution Service's online resource of post- 
2016 counterterrorism prosecutions—likely not one linked to terrorism. 
See “Knife attack by inmates wearing fake suicide vests treated as 
terrorism,” Sky News, January 10, 2020; “The Counter-Terrorism Division 
of the Crown Prosecution Service (CPS) - Successful prosecutions since 
2016,” Crown Prosecution Service. 


| These seven alleged plots/attacks involved Cherif Kouachi, Youssef 
Ettaoujar, Larossi Abballa, Mohamed Chakrar (France); Sudesh Amman, 
Usman Khan (United Kingdom); and Rafik Mohamad Yousef (Germany). 


m_ Kouachi was convicted of “association with wrongdoers with the intention 
of committing a terrorist act.” See Ben Mathis-Lilley, “The Details of Paris 
Suspect Cherif Kouachi’s 2008 Terrorism Conviction,” Slate, January 7, 
2015. 
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Sudesh Amman were examples of this. However, there were also 
prison leavers operating as part of broader cells with those not pre- 
viously convicted of terrorism-related activity. 

France saw the largest alleged cell involving an individual previ- 
ously convicted in Europe for terrorist offenses. In April 2019, Mo- 
hamed Chakrar was arrested as part of a five-person cell alleged to 
be planning a firearms attack against the Elysée and against French 
police, specifically in Seine-Saint-Denis, Paris.’? Chakrar outlined 
his allegiance to the Islamic State while in custody and stated that 
he wished to die as a martyr.” 

Previously, Chakrar had been just 15 years old when, in February 
2017, he was arrested while attempting to travel to Syria.'* He told 
French investigators that his plan was to join the Free Syrian Army, 
fight against Bashar al-Assad’s regime, and undertake humanitar- 
ian work.’* However, many Western travelers to Syria at that stage 
were aspiring to live in Islamic State-controlled territory; and a 
search of Chakrar’s iPhone revealed he possessed nasheeds calling 
for the death of non-Muslims, accessed jihadi Telegram channels, 
researched 9mm bullets, and possessed a video showing French 
police officers." 

As a result of this attempted travel, Chakrar was sentenced in 
2017 to three years detention (two of which were suspended) and 
put on probation.” 


The Threat Inside Prisons 

Concerns about incarcerated terrorism offenders carrying out fresh 
acts of ideologically motivated violence deliberately targeting prison 
staff is increasingly relevant in Europe. 

In August 2016, the Ministry of Justice in the United Kingdom 
published its findings of a review into “Islamist extremism in pris- 
ons, probation and youth justice.” Led by Ian Acheson, himself a 
former prison officer, one of Acheson’s key findings was “a more 
coordinated and rehearsed response to violent incidents” within 
prisons was required as “[s ome prisoners sentenced under the 
Terrorism Act 2000 and its successors ... aspire to acts of extreme 
violence which require not only action within prisons but oversight 
and direction from experienced operational staff working centrally.” 
The review went on to state that one of a variety of ways that Isla- 
mist extremism potentially manifested itself in prison was threats 
being made against staff." 

Acheson found this was not a problem distinct to the United 
Kingdom. Following visits to prisons in the Netherlands, France 
and Spain, the Ministry of Justice review emphasized the need for 
the “primacy of the police in resolving prison-based counter-ter- 
rorism incidents.” 

This study found four alleged plots/attacks (all resulting in actu- 
al violence) that occurred within prison by those previously convict- 
ed of terrorist activity and subsequently targeting prison staff (three 
in France, one in the United Kingdom).° Attacks inside prison by 
incarcerated terrorist convicts should not be assumed to be terror- 
ist incidents, but as will be outlined below, all four attacks had an 


n_ This included Western teenagers. See Katrin Bennhold, “Jihad and Girl 
Power: How ISIS Lured 3 London Girls,” New York Times, August 17, 2015. 


o The four alleged plots/attacks in question involved Bilal Taghi, Mohammed 
El Hannouni, and Christian Ganczarski (France); and Brusthom Ziamani 
(United Kingdom). 


alleged or apparent terrorism dimension.” 

The attacks perpetrated while in prison follow a familiar tem- 
plate: the construction and subsequent concealing of makeshift 
weapons used to stab prison employees (and, in one case, use of 
a fake suicide vest). In September 2016, for example, Bilal Taghi 
stabbed two supervisors at the Osny prison in France, where he 
was incarcerated, after he had sharpened the hinge of his cell win- 
dow into a sharp object.?° Following the attack, Taghi said that he 
had intended to kill a representative of the French government in 
tribute to the Islamic State, making clear the terrorism dimension 
to the incident.”' He was sentenced to 28 years in prison for this at- 
tack.”? Taghi had been jailed the year before due to an unsuccessful 
attempt to travel to Syria to join the Islamic State.?* 

Similarly, Mohammed Taha El Hannouni allegedly used a piece 
of broken mirror and a table leg from his cell to injure two prison 
guards in June 2019. He was subsequently charged with “attempted 
assassinations on persons holding public authority in connection 
with a terrorist enterprise.”* He was initially convicted for having 
gone to fight in Syria in 2014. Media reporting did not specify which 
group El Hannouni aligned himself with in Syria, instead reporting 
that he visited “jihadist fighting zones.””° 

A slightly unusual case involved Christian Ganczarski, a former 
associate of Usama bin Ladin, who allegedly used a razor blade and 
either a chisel or pair of scissors (reports conflict) to injure three 
prison guards at Vendin-le-Vieil prison in northern France in Jan- 
uary 2018.”° Ganczarski was a member of al-Qa ‘ida who was jailed 
for 18 years in France in February 2009 for “complicity in attempted 
murder in relation to a terrorist enterprise.” This pertained to his 
involvement in an April 2002 truck bombing of a synagogue in Tu- 
nisia that led to 21 deaths.”* 

Ganczarski was due for release in February 2018. However, he 
would then have become eligible for extradition to the United States 
where, in January 2018, he had been charged with “conspiracy to 
kill United States nationals, providing and conspiring to provide 
material support and resources to terrorists, and conspiring to 
provide material support and resources to al Qaeda.””® Upon learn- 
ing this, Ganczarski was recorded in a telephone call saying that 
he would take action to prevent his departure from France.*° His 
apparent ploy worked: following his alleged attack on the prison 
guards, Ganczarski remained in France, newly charged with “at- 
tempted assassinations on persons responsible for public authority 
in connection with a terrorist enterprise.””! 

Finally, the most recent example occurred in the United King- 
dom, in January 2020, when two prisoners at a Cambridgeshire 
prison injured four prison guards with ‘shank’ weapons they had 
constructed out of plastic and metal. Both men were wearing fake 
suicide vests at the time and were subsequently charged with at- 
tempted murder and assault.*? London Metropolitan Police stated 
they were treating the incident as a terrorist attack*’ and one of the 
alleged perpetrators—Brusthom Ziamani—was serving a 19-year 
sentence after being found guilty in February 2015 of a plot to be- 
head a British soldier. 

Discussing his motivations for this earlier plot against a soldier, 
Ziamani said he was a supporter of the Islamic State and it was 
his “duty to help my brothers and sisters” in Syria. He said that 


p More discussion is warranted in the terrorism studies community on 
what criteria should be used for labeling attacks inside prison as terrorist 
attacks. 
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“Because I have no means ov [sic] there I will wage war against the 
british [sic] government on this soil ... this is ISIB Islamic State 
of Ireland and Britain.” Ziamani went on to state that “heads will 
be removed and burned...my fellow muslim brothers these people 
want war lets kill them slaughter them and implement sharia in our 
lands and UK [sic ].”34 


Plotting Inside Prison for a Terrorist Attack Outside of Prison 
One nebulous plot in France, disrupted in July 2019, was allegedly 
planned from inside prison but was to be executed on the outside. 
In this case, the alleged protagonist was Matthieu C.,1 a convert 
jailed for the offense of apology for terrorism—in other words, “pre- 
senting or commenting favourably on terrorist acts.’** Matthieu C. 
had been housed at a variety of prisons, one of which was Chateau- 
dun in northern France. There, he encountered Zoubeir C. (housed 
in the same prison but in a different building to Matthieu C.), jailed 
for six years for heading to Syria for six months in 2014, where he 
joined up with the then al-Qa ‘ida affiliate, Jabhat al-Nusra.*° 
Zoubeir C. was due to be imminently released, and Matthieu C. 
allegedly hoped he would commit a terrorist attack upon release. 
Matthieu C. allegedly attempted to pass messages to Zoubeir C. via 
another prisoner, including details of an individual on the outside 
who could provide him with weapons. Allegedly one of the potential 
targets discussed was prison wardens.*” However, the National Pris- 
on Intelligence Service (Bureau Central du Renseignement Péniten- 
tiaire, or BCRP) had been monitoring Matthieu C. and bugged his 
cell. Both Zoubeir C. and Matthieu C. were subsequently charged 
with criminal association in July 2019." 


Geographic Scope of Previous Terror Activity 

Of the 13 individuals studied in the 12 cases, only two individuals’ 
convictions for their first offense specifically pertained to planning 
specific acts of violence in the country in which they resided. 

One was Brusthom Ziamani, who was convicted in the United 
Kingdom for having planned to kill a British solider. 

The other was Rafik Mohamad Yousef in Germany. Yousef was 
part of a cell plotting to assassinate then Iraqi Prime Minister Ayad 
Allawi during a trip to Berlin in December 2004.** After the plot 
was discovered, Yousef was jailed for eight years for membership 
in a terrorist group and attempted conspiracy to commit murder. 
(According to German authorities, the plot was insufficiently devel- 
oped to charge Yousef’s cell with attempted murder.)*? He was freed 
in 2013 and, in September 2015, stabbed a police officer in Berlin 
before being shot and killed by a fellow member of the police.*° No 
terrorist group claimed responsibility for this attack. 

Conversely, Christian Ganczarski was convicted in France for 
an attack that occurred in Tunisia; and though several of Usman 
Khan’s co-accused pleaded guilty to plotting a pipe-bomb attack 
inside the London Stock Exchange,” his guilty plea specifically re- 
lated to a plan to establish and recruit for a training camp on land 
owned by his family in Kashmir. The purpose of establishing the 
camp was to carry out terrorism acts, initially in Kashmir but with 


q_ These individuals’ names were changed in the media reporting. 


r Athird incarcerated man, Sylvain D., was also charged as part of the plot. 
However, as he is not known to be incarcerated for having committed a 
previous terrorism offense, he did not meet the criteria for inclusion in 
this study. Jérémie Pham-Lé, “In prison, detainees suspected of planning 
attacks in France,” Parisien, July 31, 2019. 


the possibility of returning to carry out attacks in the United King- 
dom in the future.” 


Frustrated Travelers and Foreign Fighters 

Six individuals’ initial convictions for terrorist activity pertained to 
either their thwarted attempts to travel to a conflict zone in order to 
participate in foreign terrorist fighting; or successful travel to these 
conflict zones and subsequent participation in the fighting. 

In 2011, Larossi Abballa was arrested for being part of a network 
facilitating jihadi travel from France to the Afghan/Pakistan border. 
In September 2013, Abballa was convicted in France of criminal 
association with a view to preparing terrorist acts. Abballa was sen- 
tenced to three years in prison (with six months suspended) and two 
years of probation.“ He was released immediately, having been on 
remand since 2011.“ In June 2016, Abballa stabbed a police officer 
to death at his property in the town of Magnanville, northwest of 
Paris, and then fatally slit the throat of the officer’s partner.” 

Three individuals who were part of alleged plots/attacks had 
previously been thwarted in their attempts to take part in the fight- 
ing in Syria and one in Iraq (Cherif Kouachi, who had attempted 
to travel there in January 2005 **). Two individuals—Mohammed 
Taha El Hannouni“’ and Zoubeir C.**—had successfully managed to 
travel to Syria (on both occasions from France), returned, and were 
subsequently convicted. Both allegedly planned or committed fresh 
acts of violence while in prison for this offense. 

The Syrian jihad therefore played a prominent—but not ubiqui- 
tous—role in the trajectory of the jihadi attackers and plotters in Eu- 
rope previously convicted there of terrorism-related offenses. Travel 
or attempted travel to Syria—between 2012 and 2017—formed the 
basis of the initial convictions for five of the 13 individuals involved 
in the 12 plots analyzed. It shows that there has already been some 
‘blowback’ in Europe from frustrated travelers and foreign fighters. 


Targets 
Nine of the 12 alleged plots/attacks involved Islamist attacks upon 
security forces that succeeded in causing casualties. 

As has been demonstrated, this manifested itself with ideolog- 
ically motivated attacks on prison guards within the prison itself 
on four occasions (three times in France and once in the United 
Kingdom). Terrorist attacks on prison guards were also allegedly 
discussed in the alleged plot that was being formulated in prison 
but to be executed outside, involving Zoubeir C. and Matthieu C.“° 

Yet the police were also specifically targeted on three occasions 
outside of the prison setting: twice in France and once in Germany. 
Rafik Yousef stabbed a police officer in Germany; Larossi Abballa 
specifically targeted law enforcement in the Magnanville stabbings; 
and Mohamed Chakrar’s cell was suspected to be planning to target 
police officers for attack in a suburb of Paris. 

There was an occasion where even though police were not the 
primary target of the plot, it still led to the death of an officer: 
during the Kouachi brothers’ attack on Charlie Hebdo, a police of- 
ficer named Ahmed Merabet was murdered by the terrorists as he 
attempted to prevent their escape.” 

Six of the nine plots that targeted police or security forces in- 
volved individuals who were known to have either been thwarted in 
their attempts to participate in foreign terrorist fighting; or had suc- 
cessfully managed to do so and subsequently returned to Europe. 
Four cases related to Syria (Chakrar, E] Hannouni, Taghi, Zoubeir 
C.); one to Afghanistan (Ganczarski); while Cherif Kouachi was 
thwarted in his attempts to travel to Iraq but was likely able to later 
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visit Yemen to receive training [see Allegiance to Foreign Terrorist 
Organizations section ]. 

While the sample of cases in this study is small, it suggests that 
‘blowback’ from foreign fighter travel among prisoners and prison 
leavers could commonly manifest itself in specifically targeting se- 
curity figures: be it the police or prison guards. 

This mirrors instructions given by the senior Islamic State ter- 
rorist Abu Mohammed al-Adnani in September 2014, who encour- 
aged supporters to “[s ]trike their police, security, and intelligence 
members, as well as their treacherous agents.”*' However, calls to 
target the police are not unique to the Islamic State: in the spring 
2014 edition of al-Qa ‘ida’s English language magazine Inspire, the 
terror group told readers that, “US, UK and French police force are 
not used to a frontline-type war. They cannot withstand a bang of 
a grenade, let alone a full car bomb blast.” 


Trajectory 

The initial offense committed (i.e., that which led to the first con- 
viction) was generally less serious than the second offense (i.e., the 
alleged plot or attack). 

However, the general trajectory should not be described as indi- 
viduals moving from non-violence first to then allegedly plotting/ 
committing a violent offense second. For almost all the 13 individ- 
uals, the first offense involved or allegedly involved the intent of 
violence in some way. 

Furthermore, while, by definition, almost all terrorism offenses 
involve some kind of violent intent, nine of the 13 were involved cas- 
es with a very close proximity to violence. This manifested itself in 
actual attack planning (Ganczarksi, Yousef, Ziamani); an attempt to 
participate in foreign fighting (Chakrar, Ettaoujar, Kouachi, Taghi); 
or successful travel to participate in foreign fighting (El Hannouni, 
Zoubeir C.). 

Three individuals were involved in cases where the proximity 
to violence was less pronounced: the facilitation of foreign fighting 
(Abballa); facilitation of training (Khan); and possession and dis- 
semination of a document likely to be useful to a person committing 
or preparing an act of terrorism (Amman). 

There was only one individual for which the first conviction did 
not involve the intent of violence: Matthieu C., who had been jailed 
in France for crimes related to being an apologist for terrorism. 


Timespan 
The timespan for recidivism and reengagement was also calculated. 
For the alleged plots/attacks outside of prison, this was measured by 
the time between the date of release from prison for the first offense 
and the date of the second arrest or attack; and for the alleged plots/ 
attacks carried out inside prison between the date of arrest for the 
first offense and the date of the second alleged plot/attack.s 

For the 11 alleged plots/attacks for which data was available, the 
time lag between the first and second offenses ranged from 14 years, 
seven months (Christian Ganczarski) to 11 days (Sudesh Amman). 
The average time lag was three years, nine months and the median 
was two years, six months. The average time lag varied when cal- 
culated for the different types of alleged plots/attacks. For alleged 
plots/attacks outside of prison, the average time lag was two years, 


s_ The plot inside prison for a (foiled) attack outside of prison has been 
omitted from this timespan analysis owing to the authors’ uncertainty over 
the dates of the two alleged attackers’ initial conviction. 


two months rising to six years, four months for alleged plots/attacks 
carried out inside prison. The spread for both types of alleged plots/ 
attacks can be seen in Figure 1. 

While such a small sample (n=11) should be treated with cau- 
tion, it suggests that there is no typical pathway or timeframe for 
terrorist reengagement or recidivism. The findings differ from those 
in Renard’s study. From his dataset of jihadi terrorism convictions 
in Belgium between 1990 and 2019, Renard identified 27 cases of 
terrorist recidivism and (suspected) terrorist reengagement,' 17 of 
which information about the date of release from prison and the 
beginning of the second offense or engagement was available. Re- 
nard reported that the majority of these 17 individuals reoffended 
or reengaged within nine months, whereas the authors found that 
only two of the 11 alleged plots/attacks analyzed in this study saw 
reoffending within this timeframe. However, seven of the 11 alleged 
plot/attacks in the authors’ study saw reoffending within three years 
of the first offense. A further three occurred between an interval 
of three and seven years and one outlier (Christian Ganczarski’s 
attack on French prison guards) took many years for subsequent 
attack planning to come to fruition. It should be noted that unlike 
Renard’s Belgium study, the authors’ survey is not exhaustive, but 
the findings suggest that for Western Europe as a whole, most of 
the risk of terrorist recidivism or reengagement may occur within 
the first few years rather than months, particularly for alleged plots/ 
attacks outside of prison. A comprehensive study of terrorist recidi- 
vism in Europe would shed more light on this question. 

Moreover, Renard questioned whether some of those individuals 
in his dataset would have recidivated were it not for the Syrian jihad 
on the basis that most offenders had at least one offense, typically 
the second, relating to the conflict there. 

The Syrian jihad played a significant role in the trajectory of the 
five individuals involved in the 12 plots analyzed in this study who 
were first convicted in relation to their attempted travel to Syria, 
suggesting that while the conflict may have acted as a pull for re- 
cidivism, it also served as an incubator for recidivist attack planning 
across Europe. 


Allegiance to Foreign Terrorist Organizations (FTOs) 

The declaration of the Islamic State’s caliphate in June 2014 led to 
predictions of al-Qa ‘ida’s demise, as potential recruits and donors 
gravitated toward what for a number of years became the more 
powerful outfit.** However, from the albeit limited dataset avail- 
able, this was not entirely reflected with the offenders studied here. 
Instead, there is a mix of those loyal to the Islamic State, those loyal 
to al-Qa ‘ida or groups in its orbit, and those with whom there is a 
degree of ambiguity. 

One perpetrator—Cherif Kouachi—explicitly acted on al-Qa‘i- 
da’s behalf despite the rise of the Islamic State. The Kouachi broth- 
ers were responsible for the Charlie Hebdo massacre. Al-Qaida 
in the Arabian Peninsula (AQAP) claimed responsibility for this 
attack.** 

In January 2015, Yemeni officials told Reuters that Kouachi 
and his brother Said Kouachi headed to Yemen in 2011 to receive 


t This included found 13 cases of terrorist recidivism, 10 cases of 
reengagement, and four cases where reengagement was subject to 
discussion. Taken together, Renard found a terrorist recidivism and 
(suspected) reengagement rate of 4.8%. 
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Figure 1: Timespan for terrorist recidivism or reengagement (n=11) 


training from AQAP.**" This was an assessment shared by French 
and U.S. officials speaking to The Wall Street Journal. Subsequent 
reporting has pinpointed this as being in the summer of that year.*” 

In the aftermath of their operation, Cherif Kouachi told French 
television (while on the run) that, “I was sent ... by al Qaeda in 
Yemen ... Sheikh Anwar al Awlaki financed my trip.”** This is a 
reference to AQAP’s influential American Yemeni cleric Anwar 
al-Awlaki, who was killed in a U.S. drone strike in September 2011. 
Before his death, al-Awlaki directed several terrorist plots in the 
West, and between his death and a 2016 study for this publication, 
Scott Shane found evidence of the cleric’s influence in more than 
half of U.S. jihadi terrorism cases.*® 

There were also those who acted on the Islamic State’s behalf. 
This included Bilal Taghi, who stabbed two prison supervisors 
during his incarceration and explicitly stated that he wanted to 
target a symbol of the French state in tribute to the Islamic State.°° 

There was also one individual who had demonstrated at least 
some ideological alignment with al-Qa ‘ida previously but who then 
carried out an attack in the name of the Islamic State. Larossi Ab- 
balla possessed al-Qa ‘ida literature at the time of his 2011 arrest 
for facilitation of travel to Afghanistan™ and Pakistan. However, 
after murdering a police officer and his partner in Magnanville, 
Abballa broadcast a Facebook live video stating that he had sworn 


u_ However, there is some ambiguity over this, as al-Qa ‘ida in the Arabian 
Peninsula’s review of the assault in Inspire magazine only refers to Said 
Kouachi being trained. See Thomas Joscelyn, “AQAP’s Inspire magazine 
contains ‘military analysis’ of Charlie Hebdo massacre,” FDD’s Long War 
Journal, September 11, 2015. 


allegiance to then Islamic State emir, Abu Bakr al-Baghdadi.® He 
claimed to have pledged allegiance to al-Baghdadi three weeks prior 
to the attack taking place. The Islamic State subsequently claimed 
credit for the attack. 

News reports have outlined that Abballa was potentially tied 
to—and influenced by—Rachid Kassim, a French terrorist who 
used the caliphate as a base from which to direct a series of plots in 
France via social media.*” A month prior to Abballa’s attack, the Is- 
lamic State’s external operations chief, Abu Mohammed al-Adnani, 
had encouraged domestic attacks rather than travel to the caliphate. 
Al-Adnani stated that “the smallest act you do in their lands is more 
beloved to us than the biggest act done here; it is more effective for 
us and more harmful to them.” This may have resonated with Ab- 
balla, who seems to have already expressed some frustration prior 
to his first conviction that the efforts of his cell were being directed 
toward the jihad overseas rather than domestically. Abballa had 
texted another member of the cell, “Do you really think they need 
us over there (in Pakistan)? ... Allah ... will give us the means to raise 
the flag here.” 

While Abballa serves as an example of an individual whose first 
offense was more closely aligned with al-Qa ‘ida and his second 
offense tied to the Islamic State, this is not the only direction of 
travel. For example, it was reported in the U.K. press a month prior 
to the attack that he allegedly committed in prison, that Brusthom 
Ziamani had defected from a prison gang loyal to the Islamic State 
to one aligned with al-Qa “ida.” (The reason why is unclear.) 

There were also cases where the influence of one group over an- 
other was ambiguous. For example, Usman Khan’s November 2019 
attack was claimed by the Islamic State.” Indiscriminate stabbing 
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is certainly a method favored by those loyal to the Islamic State. 
Furthermore, the network he was part of in the United Kingdom— 
the proscribed terrorist organization al-Muhajiroun (ALM)”—was 
known to have supplied fighters for the Islamic State in Syria.’ The 
head of ALM, Anjem Choudary, was found guilty in July 2016 of 
“inviting support for a proscribed organisation” (specifically, the 
Islamic State).7 

However, there is no evidence that has publicly emerged show- 
ing that Khan was in contact with the Islamic State, and unlike 
others who committed attacks in Europe, he had not arranged for 
a statement to be posthumously released declaring fealty with the 
Islamic State and its leadership.” Furthermore, Khan's 2012 con- 
viction was as part of an al-Qa ‘ida-inspired cell, one where he had 
been recorded discussing bomb-making instructions that had been 
published in the al-Qaida English-language Inspire magazine.” 

Ultimately, with perpetrators such as Khan, it is a challenging 
task to assess where al-Qa ‘ida’s influence ends and where the Is- 
lamic State's influence begins. 

Finally, in Germany, there was one attack with a link to Ansar 
al-Islam, a terrorist group based in northeast Iraq. Rafik Moha- 
mad Yousef, who was involved in a potential plot to assassinate 
the Iraqi Prime Minister, was a member of Ansar al-Islam, a group 
that has had ties to both al-Qaida founder Usama bin Ladin and 
Abu Musab al-Zarqawi, the founding father of the Islamic State.” 


Surveillance 

The imbalance between a growing terrorism threat and limited 
state resources is familiar to European security services. Shortly 
after the Charlie Hebdo attack, Andrew Parker, the then direc- 
tor-general of MI5, warned: “My sharpest concern ... is the growing 
gap between the increasingly challenging threat and the decreasing 


availability of capabilities to address it.’”” Some of the cases analyzed 


here reflect that dilemma. In others, however, covert surveillance 
allowed the authorities to interdict planned attacks. 

Cherif Kouachi was the only confirmed instance analyzed of a 
perpetrator reengaging without being still monitored in some way, 


v_ For example, Siddhartha Dhar was listed as a Specially Designated Global 
Terrorist and member of the Islamic State by the State Department in 
January 2018. Dhar was a former al-Muhajiroun spokesperson. See “State 
Department Terrorist Designations of Siddhartha Dhar and Abdelatif Gaini,” 
U.S. Department of State, January 23, 2018. Furthermore, according to a 
Michael Kenney study into al-Muhajiroun, among 48 individuals “involved 
in the activist network” that he interviewed between 2010-2015, “[f]our ... 
activists were later reported in the media as being killed in Iraq or Syria. 

At least one has reportedly returned to the United Kingdom. Five more 
respondents tried to leave Britain for Iraq and Syria but were caught before 
they made it and sent home by the authorities.” See Michael Kenney, 
“What is to be Done about al-Muhajiroun? Containing the Emigrants in a 
Democratic Society,’ Commission for Countering Extremism, 2019. 


by virtue of being in prison, on probation, or under surveillance.” 
Even this, however, was not down to ignorance about his potential 
threat. In fact, Kouachi’s surveillance had been stepped up after his 
brother returned from Yemen at the end of 2011, but with no evi- 
dence of new terrorism-related activity, it was discontinued in July 
2014—six months before his attack—in favor of suspects deemed 
to be of higher risk.” Both brothers were on the U.S. government’s 
central database of known or suspected international terrorists, as 
well as a smaller “no fly” list barring them from boarding flights to 
or in the United States.” 

Several of the plots involving prior terror offenders were thwart- 
ed by covert surveillance. 

Having been released from prison in October 2015 after trying to 
reach Syria (a crime for which he was sentenced to five years, with 
one suspended), Youssef Ettaoujar was put under house arrest as 
part of the French state of emergency and was closely monitored 
by the Directorate General of Internal Security (DGSI) for a month 
before his arrest in March 2016.*° Ettaoujar was eventually jailed 
for 12 years for planning a firearms attack on an unspecified target 
in France.™ 

Ettaoujar’s previous conviction related to when he and an asso- 
ciate, Salah-Eddine Gourmat, tried to travel to Syria in 2012. This 
unsuccessful attempt led Ettaoujar to be jailed for five years, with 
one year suspended. In March 2014, Gourmat made another at- 
tempt—this time successful—to travel to Syria. French authorities 
suspected Ettaoujar and Gourmat remained in contact once the 
latter had made it to the caliphate. Gourmat was eventually killed 
in a drone strike in Raqqa in December 2016." 

Teenage alleged Islamic State supporter Mohamed Chakrar was 
arrested in April 2019 in an educational center in Seine-Saint-De- 
nis, Paris, where he had been detained on probation following his 
sentencing in January 2019 for attempted terrorist travel to Syria 
two years beforehand when he was aged 15. The cell he was alleged- 
ly part of had been under surveillance by the DSGI since February 
1, 2019.** Three of his alleged accomplices were arrested in Paris on 
the same day as Chakrar after two of them were reportedly observed 
repurposing Kalashnikovs they had acquired as part of their alleged 
foiled plan to attack the Elysée and French police.** A police source 
reported a lack of supervision at Chakrar’s educational center and 


w_ _InFrance, Cherif Kouachi’s monitoring had lapsed six months before 
his attack. See Katrin Bennhold and Eric Schmitt, “Gaps in France’s 
Surveillance Are Clear; Solutions Aren't,” New York Times, February 17, 2015. 
Youssef Ettaoujar was being closely monitored by French intelligence at 
the time of his plot. See “Paris attack project: who is Youssef Ettaoujar?” 
Europe 1, March 17, 2016. It is unclear whether Larossi Abballa remained 
under phone surveillance (in relation to a wider investigation into travel to 
Syria) at the time of his attack. See Josie Ensor, David Chazan, and Henry 
Samuel, “French cop-killer says he was answering Isil’s call for lone wolf 
attacks during Ramadan,” Telegraph, June 14, 2016. Mohamed Chakrar 
and his cell were being monitored by French authorities at the time of their 
alleged plot. See “Attack foiled against the Elysee Palace: a fifth suspect 
arrested in Strasbourg,” Parisien, May 7, 2019. In Germany, Rafik Mohamad 
Yousef’s electronic tag had been removed hours before he carried out his 
attack. See Justin Huggler, “Islamic terrorist shot dead after Berlin attack 
on policewoman,” Telegraph, September 17, 2015. In the United Kingdom, 
Usman Khan was being monitored by British authorities, including partial 
surveillance by MI5, at the time of his attack. See Kim Sengupta, “Usman 
Khan: London Bridge attacker was ‘being monitored by MI5, but not under 
constant watch,” Independent, November 30, 2019. Sudesh Amman was 
under 24/7 armed surveillance at the time of his attack. See Vikram Dodd 
and Dan Sabbagh, “Streatham attacker was released amid fears he felt 
terrorism ‘justified/” Guardian, February 3, 2020. 
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he was alleged to have met up with his accomplices in person on 
several occasions.*° Chakrar was also reportedly friends with a fifth 
accomplice, arrested in Strasbourg 11 days later for his alleged 
planned role broadcasting a video of allegiance to the Islamic State 
on behalf of the cell.°° 

There were also those for whom surveillance or electronic mon- 
itoring did not prevent an attack. In Germany, Rafik Mohamad 
Yousef removed an electronic ankle-monitoring device on the day 
he stabbed a police officer who had been called to a district in Berlin 
after members of the public reported that a man with a knife was 
acting aggressively and threatening passers-by in the area.*” Sudesh 
Amman was another example. Having been released automatically 
from prison in the United Kingdom—where his behavior had al- 
ready caused concern—he was placed under full surveillance. With- 
in days the officials monitoring Amman were ordered to be armed. 
The following week, they shot him dead as he began stabbing pass- 
ers-by on a London High Street with a knife he stole in a shop.** 

It is not clear whether Magnanville attacker Larossi Abballa 
was still under surveillance at the time of his fatal stabbing of a 
French police commander and his partner in June 2016. Having 
been convicted in 2013 of aiding a group that had been recruiting 
fighters for jihad in Pakistan, Abballa was released owing to time 
spent in jail awaiting trial and was placed under surveillance until 
November 2015. He was later placed under phone surveillance as 
part of an investigation that began in February 2016 into a group 
believed to be traveling to Syria, with police sources stating that 
while the evidence collected suggested he was radicalized, it had not 
indicated that he was preparing to carry out an attack.*? However, 
it is unclear whether this investigation had been completed by the 
time of his attack and therefore it is unclear whether he remained 
under surveillance.* 


The Management of Terrorism Offenders 

The cases of alleged plots/attacks inside prisons illustrate recurrent 
policy questions in Europe on the management of terrorism offend- 
ers. Brusthom Ziamani and Mohammed Taha El Hannouni were 
each separately able to mount attacks on prison guards from within 
the mainstream population, in the latter case prompting calls from 
French prison unions for radicalized prisoners to be moved to “spe- 
cialised establishments.””° Bilal Taghi’s attack on prison officers, by 
contrast, occurred on a dedicated counter extremism wing that was 
piloting the segregation of offenders who were known to be radical- 
ized but who were also assessed to not present the highest security 


x The Telegraph reported that Abballa “was under surveillance and his phone 
was tapped.” However, The New York Times, The Guardian, and BBC News 
reported the fact that he had been under phone surveillance earlier in the 
year without clarifying whether that surveillance continued or not. These 
outlets respectively reported: “More recently, Mr. Abballa came to the 
attention of the French law enforcement authorities when he was among 
several people questioned in a counterterrorism inquiry that Mr. Molins’s 
office began on Feb. 11 into a group believed to be planning to go to Syria;” 
“[Abballa] had been under phone surveillance this year in connection to an 
inquiry about another man leaving for Syria;” and “Abballa had reportedly 
been the subject of a recent anti-terrorist investigation into a Syrian jihadist 
group, including having his phone tapped.” See Josie Ensor, David Chazan, 
and Henry Samuel, “French cop-killer says he was answering Isil's call for 
lone wolf attacks during Ramadan,” Telegraph, June 14, 2016; Alissa J. Rubin 
and Lilia Blaise, “Killing Twice for ISIS and Saying So Live on Facebook,” 
New York Times, June 14, 2016; Angelique Chrisafis, “French prime minister 
defends security forces after Isis-linked murders,” Guardian, June 15, 2016; 
and “Who was French police killer Larossi Abballa?” BBC, June 14, 2016. 


risk.” Christian Ganczarski’s alleged attack on guards in a French 
high security prison occurred while he was in isolation ahead of his 
(now delayed) extradition to the U.S.°? 

They also raise difficult questions about the effectiveness of ef- 
forts to rehabilitate and reintegrate ideologically motivated offend- 
ers. London Bridge attacker Usman Khan was monitored by MI5 
after he left prison, although not under the same level of day-to-day 
scrutiny as Amman.°* He was in central London to attend a confer- 
ence on rehabilitation organized by Learning Together, an educa- 
tional initiative that brought students from Cambridge University 
together with current and former prisoners to discuss criminal jus- 
tice. Khan had previously worked with the group and appeared in 
their promotional literature as a case study to show how they helped 
rehabilitate terrorists. 

Following Khan’s attack, the psychologist who helped design the 
United Kingdom’s deradicalization programs acknowledged: “[W] 
e have to be very careful about ever saying that somebody no longer 
presents a risk of committing an offence. I don’t think you can ever 
be sure.””® 


Part Two: What U.K. Data Reveals about the Scale 
of the Prisoner Threat 

This section expands upon a comprehensive dataset of Islamist 
terrorism convictions and attacks in the United Kingdom between 
the beginning of 1998 and the end of 2015 to provide a quantitative 
study of the extent to which broader recidivism and reengagement 
by convicted terrorists is common in that country. It provides the 
terrorist recidivism rate for all U.K.-based Islamist terrorism con- 
victions and attacks during this timeframe. Whereas part one of 
this study was more focused on the nature of the threat, part two 
uses a country-specific case study in an attempt to explore the scale. 


Inclusion Criteria 

Instances of convicted terrorists reengaging in the form of a planned 
or attempted attack—as narrowly defined by the authors—are un- 
common. The database on which part one of this study is drawn 
contained only 12 incidents of individuals previously convicted of 
terrorism-related offenses who went on to allegedly plan or carry 
out a terrorist attack either after or prior to release from prison. 
One important caveat: the purpose of the database was to track the 
threat to Europe following the rise of the Islamic State rather than 
a study on terrorist recidivism, and so while attempts were made 
to be as exhaustive as possible, there have potentially been further 
examples of plots/attacks involving individuals previously convicted 
of terrorism offenses. 

However, data previously collected by one of the authors sug- 
gests that broader recidivism and reengagement is complex and 
that there are overlapping areas between terrorist recidivism nar- 
rowly conceived as two distinct convictions for terrorist activity 
and broader crime-terrorism recidivism, understood as including 
individuals who are convicted on two separate occasions for at least 
one terrorist offense during one of those convictions. This section 
draws on a comprehensive dataset of 269 Islamist terrorism con- 
victions and attacks in the United Kingdom between the beginning 
of 1998 and the end of 2015 that was produced for the U.K. Home 
Office and published by the Henry Jackson Society in 2017.°° Cas- 
es were identified through open-source material including news 
and legal archives and monitoring police and Crown Prosecution 
Service statements and social media, as well as court records and 
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indictments that were obtained on request.’ 

Between 1998 and 2015, there were 10 cases of individuals who, 
at the time of arrest for the second (and, in one case, third) U.K. 
terrorist offense, had already been convicted of a terrorist offense 
in the United Kingdom within this timeframe. An increased policy 
focus on jihadi prisoners and prison leavers led the author to calcu- 
late and publish here for the first time the terrorist recidivism rate 
in the U.K. dataset: 3.7%. Here, terrorist recidivism is understood 
as individuals who are convicted on two separate occasions for at 
least one terrorist offense each time. 

This terrorist recidivism rate is low, especially compared to 
recidivism generally. It also falls within the range of terrorist re- 
cidivism rates from 12 terrorism studies between 2004 and 2020 
compiled by Renard for his study for this publication, which ranged 
from 0% in a number of studies (including Marc Sageman’s study of 
172 jihadis in 2004) to 8.3% in a 2013 study in Indonesia. 

None of the 10 cases in the author’s U.K. study, however, in- 
volved attack planning, with the perpetrators typically favoring 
fundraising for terrorist purposes, or inciting murder. Six of these 
10 cases involved members of the proscribed U.K.-based terrorist 
group al-Muhajiroun.°” 

The author identified a further three cases of individuals who, at 
the time of their arrest for the U.K.-based terrorist offense that war- 
ranted their inclusion in the dataset, had previously been convicted 
of terrorist activity overseas. These cases involved two individuals 
convicted in absentia in 2003 and 2011 for alleged bomb attacks in 
Morocco and Bahrain, respectively, and an individual convicted of 
an illegal border crossing in Indian-controlled Kashmir while al- 
legedly fighting with the Kashmiri separatist group Harakat-ul-Mu- 
jahideen.’” Including these cases, which are questionable owing to 
the lack of judicial independence in these countries, would raise the 
terrorist recidivism rate to 4.8%, which coincidentally is also the fig- 


y The study used a quantitative methodology for data collection. To be 
included, individuals had to have been convicted for terrorism offenses or 
have committed suicide attacks in the United Kingdom, and in addition, 
they must have been demonstrably motivated by Islamism. Alongside 
keyword searches and open-source research, findings were cross- 
referenced with annual reports by the Independent Reviewer of Terrorism 
Legislation and Home Office counterterrorism statistical bulletins. 
However, due to the length of the period studied and changes in internal 
recording of terrorism offenses, there may have been a small number of 
cases that are not included in this dataset. 


z_ Al-Bashir Mohammed al-Fagqih, convicted in the United Kingdom in 2007 
of possessing information likely useful for terrorism, had previously been 
convicted for involvement in suicide bombings in Morocco. See Secretary 
of State for the Home Department v AV [2009] EWHC 902 (Admin), April 
30, 2009, para. 1; “Treasury Designates UK-Based Individuals, Entities 
Financing Al Qaida-Affiliated LIFG,” U.S. Department of the Treasury, 
February 8, 2006. Abdul Raoof Al Shayeb, convicted in the United Kingdom 
in 2015 of possessing information likely useful for terrorism, had previously 
been convicted for involvement in a bomb attack in Bahrain. See Hannah 
al-Othman, “Man found with memory card of military files is convicted of 
terror offences,” Evening Standard, December 16, 2015; “Chief of Public 
Security statement on Abdul Raoof Al Shayeb sentencing,” Bahrain 
News Agency, December 17, 2015. Rangzieb Ahmed, convicted in the 
United Kingdom in October and December 2008 of a variety of terrorist 
offenses, including directing terrorism and membership of al-Qa ‘ida, had 
previously pleaded guilty in India to an illegal border-crossing offense 
after having been arrested allegedly fighting with Harakat-ul-Mujahideen. 
See R v Ahmed & Anor [2011] EWCA Crim 184, February 25, 2011, para. 
12; “Al-Qaeda terror trial: Rangzieb Anmed was highest ranking Al-Qaeda 
operative in Britain,” Daily Telegraph, December 18, 2008; Testimony of 
Rangzieb Ahmed, Cageprisoners, undated. 


ure for terrorist recidivism and suspected reengagement calculated 
in Renard’s Belgium study." This new statistic demonstrates that 
solely looking at domestic terrorist convictions can only provide an 
insight into part of the overall problem. 

The author identified a further 12 U.K. terrorist offenses within 
this timeframe (beginning of 1998 to end of 2015) that had been 
committed by individuals who had a prior criminal record for 
non-terrorism activities that the author of the dataset interpreted 
as containing an extremism-related motivation or element. These 
were typically for public disorder (such as harassment and threat- 
ening behavior) or low-level criminal damage, often in relation to 
public al-Muhajiroun activism or other extreme networks. 

Three of these 12 cases were planned or attempted attacks in 
the United Kingdom.” In the three cases, the prior convictions had 
been for minor (albeit suspected extremism-related) public order 
offenses. 

The first case was Waheed Mahmood, who was jailed for his 
role in an al-Qa ‘ida-directed 2004 fertilizer bomb plot. During the 
trial, Mahmood’s Islamist convictions were reported by the media, 
including that during the 1990s he had attended radical political 
meetings in Crawley and Luton and that, in 1993, he had received 
a conditional discharge for using “threatening, abusive or insulting 
words during a Muslim demonstration.”* 

The second case was Shah Rahman,” who was convicted along- 
side London Bridge attacker Usman Khan in 2012. During sen- 
tencing, the judge stated that while the cell was under surveillance 
Rahman had drawn attention to himself by being arrested for a 
“minor, jihadist inspired, public order offence” in London.” 

The third case was Michael Adebolajo, who was jailed for killing 
Fusilier Lee Rigby in 2013. Adebolajo had assaulted a police officer 
during an al-Muhajiorun solidarity rally for a terrorism suspect in 
2006.'°° 

These combined 25 cases—of terrorist offenses being committed 
by individuals with previous convictions for terrorist activities or 
what the author interpreted as extremism-related activities —ac- 
count for 9.3% of U.K. terrorism convictions between 1998 and 
2015. The authors acknowledge that categorizing criminal behavior 
as extremism-related is a fine judgment, but nonetheless consider 
it a useful area for further research. 

A further 44 terrorist offenses were carried out by individuals 
with previous convictions that did not include terrorist activities or 
behavior that the author interpreted as extremism-related. These 
were for a variety of offenses, notably public disorder, theft, assault, 
drug-related, and possession of offensive weapons or firearms. Tak- 


aa The authors acknowledge that this is not a direct comparison given several 
differences between the inclusion criteria for each dataset. 


ab The others typically involved facilitation, such as fundraising or inciting 
terrorism, or were aspirational offenses, such as possessing information 
likely useful for terrorism. 


ac Rahman was also among those in the U.K. dataset who went on to commit 
an ideologically motivated attack in prison following conviction for a 
terrorism-related offense. In April 2014, Rahman and two other terrorism 
offenders—Manu Kwaku Asiedu, convicted for his role in the attempted 
London Underground bombings on July 21, 2005, and Jewel Uddin, 
convicted for his role in an attempted bomb plot against an English Defence 
League protest in Dewsbury in 2012—physically attacked former army 
lieutenant and convicted murderer Jeremy Green, in what the prosecution 
later alleged was revenge for the latter’s service in Afghanistan against the 
Taliban. The incident was not treated as terrorism. See “Terrorists attacked 
murderer at gym in Wakefield jail,” Yorkshire Post, October 22, 2015. 
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en together, therefore, one in six (16.4%) U.K. terrorist offenses be- 
tween 1998 and 2015 was committed by an individual with a prior, 
non-extremism or terrorism-related criminal record. 

The relationship between terrorism and criminality is an in- 
creasing area of focus in academia. Furthermore, it encapsulates 
the fears of many Western policymakers over the nature and scale of 
radicalization in prisons, particularly when this involves a criminal 
offender being reconvicted for a terrorism-related offense. Data on 
current prisoners assessed as radicalized illustrates the potential 
scale of the problem. In the United Kingdom, there are 238 peo- 
ple in custody for terrorism-related offenses,’ however, up to 800 
prisoners are managed by a counterterrorism specialist case man- 
agement process at any one time.’ In France, as of the end of 2018, 
500 detainees convicted of terrorism charges were in prison, with a 
further 1,200 reported to have been radicalized.’ Approximately 
90% of those 1,700 people will be released by 2025. 


Conclusion 
After studying decades’ worth of data in Belgium, Thomas Renard’s 
study contended that the threat posed by terrorism recidivists to 
Europe may be exaggerated. Using the United Kingdom as a refer- 
ence point, this study supports Renard’s finding of a low rate when 
assessing recidivism among U.K. offenders convicted of multiple 
terrorism offenses on separate occasions within the United King- 
dom itself. 

However, when other factors are considered—individuals who 
at the time of their arrest for the U.K.-based terrorist offense had 


previously been convicted of terrorist activity overseas; and terrorist 
offenses carried out by individuals with previous convictions that 
the author interpreted as extremism-related—the rate grows ap- 
preciably. 

Furthermore, as an increased number of individuals who sup- 
ported the Islamic State are released across Europe, this may lead to 
an increase in recidivism and reengagement. After all, what applied 
to jihadis’ conflicts of the past may not hold in the era of the caliph- 
ate. As Aimen Dean, a former member of al-Qaida who became a 
spy for British intelligence, has written, “I look back in to my time 
in Bosnia and the Philippines, even my first visit to Afghanistan, as 
almost innocent expeditions in pursuit of an ideal” in contrast to the 
gruesome brutality of modern jihadi conflicts.'* 

The precise nature of the threat posed by those soon due for re- 
lease having previously committed a previous terrorism offense will 
only become clear in the months and years ahead. Yet, as Renard 
acknowledges, it is unlikely that the problem set posed by ‘prison 
leavers’ will disappear entirely. The internal threat to prisons posed 
by radicalized prisoners will also likely endure. Governments will 
need to be able to mitigate both trajectories simultaneously. 

While much of this study has focused on attack planning, it is 
also important for policy makers to broaden their horizons beyond 
acts of violence. Convicted terrorists who use their gravitas and 
credibility to recruit others to the Islamist cause—inside or out- 
side of prison—are clearly still a national security concern, even if 
they are not breaking the law or planning a fresh attack themselves. 
CTC 
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Table 1: Dataset (ordered by date of secondary offense) 


Nature of 
offense 


Attempted 
terrorist travel 
(Iraq) 


Cherif 
Kouachi 


January 
2005 


December 
2004 


Attempted 


Rafik 
Mohamad 


Vinaat Germany; 


membership 
of a terrorist 


group 


Attempted 
terrorist travel 
(Syria) 


Youssef 
Ettaoujar 


January 
2015 
June 2003 


Facilitation of 
terrorist travel 
(Afghanistan 
and Pakistan) 


Larossi 
Abballa 


Attempted 
terrorist travel 
(Syria) 


Bilal Taghi 


Complicity 
in attempted 
murder in 
relation toa 
terrorist 
enterprise 
(Tunisia) 


Christian 
Ganczarski 


murder of Iraqi 
Prime Minister 
during a visit to 


Country 
of 


conviction 


France 
France 


France 


France 


Outcome 


Spent one 
year, eight 
months in 
prison, then 
released 
under 
judicial 
supervision. 
Eventually 
sentenced 
to three 
years (time 
served, 
released im- 
mediately) 


Sentenced 
to eight 
years in 
prison; 

released in 

2013 


Sentenced 
to five years 
in prison 
(one year 
suspended); 
released in 
October 
2015 


Sentenced 
to three 
years in 

prison (six 
months 

suspended, 
two years of 
probation) 


Sentenced 
to five years 
in prison 


Sentenced 
to 18 years 
in prison 


Date of 
secondary 


offense/ 
alleged 
offense 


September 
2015 


March 2016 


September 
2016 


Country 
of convic- 
tion/ 
accusa- 


tion 


France 


France 
France 


France 


Nature of 
offense/ 
alleged 
offense 


Outcome 


Firearms 
terrorist at- 
tack (Charlie 
Hebdo office, 
police offi- 
cers) 


Killed by 
French police 


Edged weap- 
on terrorist 
attack (po- 
lice officer) 


Killed by 
German police 


Preparation 
for an attack 
of unspeci- 
fied nature 


Jailed for 12 
years in August 
2019 


Edged 
weapon 
terrorist 

attack 

(police offi- 
cer, civilian) 


Killed by 
French police 


Edged 
weapon 
terrorist 

attack 

(prison 
guards) 


Found guilty; 
jailed for 28 
years 


Edged 
weapon 
terrorist 

attack 

(prison 
guards) 


Charged with 
attempted 
murder 
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Mohamed 
Chakrar 


Mohammed 
Taha El 
Hannouni 


Attempted 
terrorist travel 


(Syria) 


Terrorist travel 
(Syria) 


France 


Sentenced 
to three 
years in 

prison (two 
years sus- 
pended) 


Sentenced 
to seven 
years in 


April 2019 


Firearm 
terrorist 
attack 
(police) 


Edged 
weapon 
terrorist 


France 


Awaiting trial 


Awaiting trial 
for 
attempted 
murder with a 


attack (pris- 


terrorist 
on guards) 


association 


prison 


_ 


Zoubeir C.; 
Matthieu C. 


Brusthom 
Ziamani 


Sudesh 
Amman 


Unspec- 
ified, 
post-2014 
(Zoubeir 
C.); un- 
specified 
(Matthieu 
C.) 


December 
2010 


May 2018 


Terrorist travel 
(Syria, Zoubeir 
C.); apology for 
terrorism (Mat- 
thieu C.) 


Engaging in 
conduct in 
preparation for 
acts of terror- 
ism (Kashmir) 


Preparation for 
an act of ter- 
rorism (United 
Kingdom) 


Possession and 
dissemination 
of terrorism-re- 
lated material 


United 
Kingdom 


United 
Kingdom 


United 
Kingdom 


Sentenced 
to six years 
in prison 
(Zoubeir 
C.); unspec- 
ified 
sentence 
in France 
(Matthieu 
C.) 


Sentenced 
to 16 years 
in prison 
witha 
five-year 
extended 
licence peri- 
od (reduced 
from an in- 
determinate 
sentence on 
appeal) 


Sentenced 
to 19 years 
in prison 
with a five- 
year extend- 
ed licence 
period (re- 
duced from 
22 years on 
appeal) 


Sentenced 
to three 
years and 
four months 
in prison 


November 
2019 


January 
2020 


February 
2020 


Planned 


explosives 


attack 
(various 
targets 


discussed, 
including 


prison 
guards) 


Edged 
weapon 
terrorist 

attack 


(civilians) 


Edged 
weapon 
terrorist 

attack 

(prison 
guards) 


Edged 
weapon 
terrorist 

attack 

(civilians) 


United 
Kingdom 


Charged with 
criminal 
association; 
further details 
unknown 


Killed by 
British police 


Charged with 
attempted 
murder, actual 
bodily harm, 
and common 
assault; 
awaiting trail 


Killed by British 
authorities 
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The QAnon Conspiracy Theory: A Security 


Threat in the Making? 


By Amarnath Amarasingam and Marc-André Argentino 


The QAnon conspiracy theory, which emerged in 2017, has 
quickly risen to prominence in the United States. A survey 
of cases of individuals who have allegedly or apparently 
been radicalized to criminal acts with a nexus to violence 
by QAnon, including one case that saw a guilty plea on a 
terrorism charge, makes clear that QAnon represents a 
public security threat with the potential in the future to 
become a more impactful domestic terror threat. This is 
true especially given that conspiracy theories have a track 
record of propelling terrorist violence elsewhere in the 
West as well as QAnon’s more recent influence on main- 
stream political discourse. 


enerally speaking, law enforcement and public pol- 

icy attention with respect to terrorism and political 

violence in North America tends to focus on jihadi 

or far-right extremism.’ At first glance, QAnon, the 

bizarre assemblage of far-right conspiracy theories 

that holds that U.S. President Donald Trump is waging a secret war 

against an international cabal of satanic pedophiles seems to pres- 

ent a far lesser threat to public security. However, QAnon has con- 

tributed to the radicalization of several people to notable criminal 

acts or acts of violence. In light of these events, this article attempts 

to take stock of the violence this bizarre set of conspiracy theories 

has engendered thus far and asks whether it should be seen as a 
security threat in the making.” 

Though less organized than jihadi or far-right extremists, the 

authors argue that QAnon represents a novel challenge to public 
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security. This is consistent with a May 2019 report by the United 
States Federal Bureau of Investigation, which details the increas- 
ing influence of anti-government, identity-based, or fringe political 
conspiracies, including QAnon, on motivating criminal or violent 
activity. The report, as presented by Yahoo News, claims that “based 
on the increase volume and reach of conspiratorial content due to 
modern communication methods, it is logical to assume that more 
extremist-minded individuals will be exposed to potentially harm- 
ful conspiracy theories, accept ones that are favorable to their views, 
and possibly carry out criminal or violent actions as a result.” 

Further, the report emphasizes that the internet allows for a 
“crowd-sourcing” effect wherein “conspiracy theory followers them- 
selves shape a given theory by presenting information that sup- 
plements, expands, or localizes its narrative.”* This effect appears 
particularly salient with QAnon, where followers are directed to 
take interpretation and action into their own hands, rather than at 
the explicit direction of the anonymous user (known only as Q) be- 
hind the movement. QAnon is thus markedly different from other 
far-right extremist groups and jihadi groups, as it lacks both a clear 
organizational structure and a centralization of interpretive duties. 

In this article, the authors provide further context on the emer- 
gence of QAnon, a summary of five criminal cases with a nexus to 
violence motivated by QAnon, including one case that resulted in a 
guilty plea on a terrorism charge. The data presented here was col- 
lected by the authors from various sources from 2018 to the present, 
including QAnon community messaging pages, social media pages 
of individuals radicalized to criminal or violent activity, and publicly 
accessible news reports. 


What is the QAnon Conspiracy? 

The QAnon conspiracy’ emerged on Saturday, October 28, 2017, on 
4chan’s* /pol/ (politically incorrect page) in a thread called “Calm 
Before the Storm,” when an anonymous user signing off as ‘Q’ stat- 
ed that “Hillary Clinton will be arrested between 7:45 AM - 8:30 
AM EST on Monday - the morning on Oct 30, 2017.”° Q’s nom de 
plume is in reference to “Q” clearance, a clearance level in the Unit- 
ed States Department of Energy. 

However, QAnon finds its origins a year prior in the Pizzagate 
conspiracy theory,’ which alleges coded words and satanic symbol- 
ism purportedly apparent in John Podesta’s emails, hacked during 
his tenure as chair of Hillary Clinton’s 2016 U.S. presidential cam- 


a According to News Guard, which rates the credibility of news and 
information sites, “4chan is an anonymous— users never need to make an 
account or pick a username, even a pseudonymous one— image board.” 
From a functional perspective, “it is broken up into threads where users 
can discuss different topics; moderation on the platform is virtually non- 
existent. 4chan is rife with pornography and other posts that many would 
consider shocking or inappropriate, such as violent imagery and racial 
imagery.” “4chan.org,” News Guard Tech, Accessed July 2020. 
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A QAnon flag is held by a protester at the Governor's Mansion, in Salem, Oregon, on April 25, 2020, during a rally against economic-clo- 


sure efforts aimed at minimizing the impact of COVID-19. (John Rudoff/Sipa USA/Sipa via AP Images) 


paign, point to a secret child sex trafficking ring at a pizza restau- 
rant in Washington, D.C., called Comet Ping Pong. Pizzagate came 
to a head in December 2016 when Edgar M. Welch (whose case 
is discussed in detail below) traveled from North Carolina “to the 
popular DC pizzeria Comet Ping Pong with a handgun and an as- 
sault rifle to ‘self-investigate’ the validity of the 4chan conspiracy.” 
QAnon, beginning in 2017, thus originated out of the Pizzagate 
conspiracy theory, retaining the central belief that a cabal of pow- 
erful elites control the world, using their power to covertly abuse 
children. 

Qs claim on 4chan to have special government access and that 
he/she is part of a wider “anon genre” of government officials with 
top secret information is not entirely novel. Before Q, several 4chan 
posters asserted they had special government access, including FBI- 
Anon? and HLIAnon” in 2016, and CIAAnon" and WHInsider- 
Anon” in 2017. QAnon devotees, many of whom may be familiar 
with this “anon genre,’ thus are familiar with Q’s apparent need for 
anonymity and presumably take it as a sign of credibility. 

In July 2020, nearly three years following Q’s emergence, there 
remains no consensus on who the original Q was and who manages 
the account today. However, there is a fair amount of evidence that 
demonstrates how QAnon grew to prominence from the narrow 


confines of 4chan and 8chan.> According to how one news outlet 
summed up a 2018 NBC News investigative report, the original Q 
post “would have gone mostly unnoticed if not for three people - 
Tracy Diaz, a YouTube vlogger, and 4chan moderators Pamphlet 
Anon, identified as Coleman Rogers, and BaruchtheScribe, a South 
African man named Paul Furber.”** NBC News reported that Rog- 
ers and Furber reached out to Diaz, asking her to leverage her large 
YouTube following to promote the first ‘Q’ posts. Without sharing 
the 4chan thread with Diaz’ viewership, QAnon may never have 
grown beyond its small following on the image board site. 

The authors have observed that QAnon supporters purport that 
their claims are empirical and do not ask that their assertions be 


b According to News Guard, which rates the credibility of news and 
information, “8chan bills itself as ‘the Darkest Reaches of the Internet.” 
Furthermore, “anyone can anonymously post text, videos, images, and 
other files as well as links to external websites. Content appears on ‘boards; 
which anyone can create.” “8ch.net,” News Guard Tech, Accessed July 
2020. In 2019, 8chan was used to announce deadly attacks at mosques 
in Christchurch, New Zealand; a synagogue in Poway, California; and a 
Walmart in El Paso, Texas. In March 2019, as the New Zealand gunman live- 
streamed his rampage, 8chan allowed the grisly footage to reach millions. 
Subsequently, 8chan was taken down in August 2019. 8chan returned 
as 8kun in November 2019, with several boards dedicated to QAnon. 
Benjamin Goggin, “8chan — the website connected to mass shootings 
and conspiracy theories — has relaunched as 8kun,” Business Insider, 
November 3, 2019. 


* This sentence was amended after publication to make clear the direct 
quote was from a summary by another news outlet (see endnote 13) of the 
reporting by NBC News. 
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taken at face value. The QAnon community is guided by the oft-re- 
peated maxim, “do your own research.“ Imitating source citation 
and evidence presentation in academic scholarship, QAnon fol- 
lowers regularly engage in elaborate presentations of evidence to 
substantiate their claims. In this vein, they often self-identify as 
investigative journalists or conspiracy researchers.” 

QAnon also represents a militant and anti-establishment ide- 
ology rooted in an apocalyptic desire to destroy the existing, cor- 
rupt world to usher in a promised golden age." This position finds 
resonance with other far-right extremist movements, such as the 
various militant, anti-government, white nationalist, and neo-Nazi 
extremist organizations across the United States. In February 2020, 
Omega Kingdom Ministries, in effect a QAnon church, was estab- 
lished in the United States and other countries where the QAnon 
conspiracy acts as an interpretive lens for the Bible and vice versa, 
and in which adherents are subjected to formalized religious in- 
doctrination into QAnon.° QAnon followers share roots with con- 
spiracy theories that have fed other anti-government movements, 
such as the 90s militias that feared the “New World Order,’ or the 
anti-government apocalypticism and religious fervor of the Branch 
Davidians.” 

Recent criminal cases with a nexus to violence involving QAnon 
followers show how QAnon has contributed to the radicalization 
of ideologically motivated violent extremists (IMVE).® According 
to the FBI, QAnon and other fringe conspiracy theories could “very 
likely motivate some domestic extremists, wholly or in part, to com- 
mit criminal and sometimes violent activity” and noted that “one 
key assumption driving these assessments is that certain conspiracy 
theory narratives tacitly support or legitimize violent action.” Be- 
low, the authors provide a chronological summary of five criminal 
cases with a nexus to violence motivated, in part at least, by QAnon 
radicalization. They start with the aforementioned Edgar Maddi- 
son Welch, whose armed search of the Comet Ping Pong pizzeria 
predated QAnon but represents an ideological precursor to other 
QAnon-motivated actions. 


Notable Cases with a Nexus to Violent Crime Linked 
to the QAnon Conspiracy 

The authors now outline five criminal cases below with a nexus to 
violent crime linked to the QAnon conspiracy.‘ 


c Omega Kingdom Ministries (OKM) is part of a network of independent 
congregations (or ekklesia) called Home Congregations Worldwide (HCW). 
It has online services at the moment due to the COVID-19 pandemic. 

OKM, however, has central hubs in the United States, Canada, the United 
Kingdom, Germany, Japan, and Australia where in-person meetings and 
trainings take place. Its infrastructure is different than a traditional church 
as the services in non-pandemic times take place in the home of a leader 
with 10 to 12 other individuals. During these services, the first hour is 
dedicated to a liturgy where QAnon conspiracy theories are reinterpreted 
through the Bible. In the second hour, during an analysis of Qdrops, QAnon 
serves as a lens to interpret the Bible itself. Marc-André Argentino, “The 
Church of QAnon: Will conspiracy theories form the basis of a new religious 
movement?” Conversation Canada, May 18, 2020. 


d_ The inclusion criteria for selected cases is whether there is a nexus to 
violent crime. See “Violent Crime,” National Institute of Justice. The authors 
have excluded criminal cases where this was not apparent. Jessica Prim, 
though not charged with a violent crime, was included due to the apparent 
threats she made in her livestream against presidential candidate Joe 
Biden. 


Edgar Maddison Welch 

Edgar Maddison Welch, a then 28-year-old from Salisbury, North 
Carolina, entered the Comet Ping Pong pizza restaurant in Wash- 
ington, D.C., on December 4, 2016, with an AR-15 rifle and .38 re- 
volver” to potentially attempt to free children he believed might be 
trapped in the building as part of a sex-trafficking ring.?! Welch, a 
volunteer firefighter with two children,” had a criminal record for 
incidents involving minor drug possession and driving under the 
influence of alcohol in 2007 and 2013, respectively. 

Welch entered Comet Ping Pong with his AR-15 visible, causing 
employees and patrons to flee, to search for evidence of child traf- 
ficking.”’ Finding none, he shortly thereafter surrendered himself to 
the police on scene.”* Welch also admitted that there was a loaded 
shotgun and ammunition in his car.”° An FBI affidavit notes that, 
“the evidence from Welch's cellphone also suggest that Welch at- 
tempted to recruit at least two other people to join him,” though he 
was unsuccessful.”° 

Evidence found on Welch’s cellphone indicates he watched sev- 
eral YouTube videos describing the ‘Pizzagate’ conspiracy theory in 
the days preceding his confrontation.”’ Upon arrest, Welch corrob- 
orated that he had heard ‘news’ reports that there was a child-sex 
trafficking ring in Comet Ping Pong restaurant.?* 

Welch was charged with federal and local weapons violations 
and pleaded guilty to a federal charge of interstate transportation 
of a firearm and ammunition and a D.C. charge of assault with 
a dangerous weapon.” He was sentenced to four years in prison 
in June 2017, with three years of supervised release following his 
term in prison.*° Welch remains in prison and has expressed regrets 
about his actions but maintains elements of the Pizzagate theory 
are true.” 


Matthew Philip Wright 

On June 15, 2018, Matthew Philip Wright, a 30-year-old, unem- 
ployed Marine veteran from Henderson, Nevada, drove an ar- 
mored truck onto the Mike O’Callaghan-Pat Tillman Memorial 
Bridge near the Hoover Dam.** Wright parked his vehicle on the 
southbound lanes, blocking traffic,** and stood outside the vehicle 
with a sign calling for the release of the “OIG Report,” which CNN 
reported was an “apparent reference to the US Justice Department’s 
internal watchdog report on the department’s handling of the Hil- 
lary Clinton email probe.” The 568-page report had been released 
the previous day, making Wright’s message unclear.*° QAnon fol- 
lowers expected that the document would contain revelations about 
nefarious government actors, suggesting Wright had engaged with 
QAnon theories.*° 


e Welch also allegedly hit and seriously injured a 13-year-old with his car 
in 2016, though the authors were not able to determine whether the 
investigation, which remained open during his arrest for the Comet 
incident, resulted in charges. Jonathan Drew and Tom Foreman Jr., “DC 
pizza shop gunman regrets actions, still believes fake Hillary Clinton child 
sex ring story,” Global News, December 8, 2016. 


f Qand QAnon influencers hyped up the OIG report in question with the 
belief it would reveal incriminating evidence that would bring down the 
Democrats. QAnon adherents were thoroughly disappointed when the 
report was released, as it did not contain the revelations they expected. 

‘Q’ responded to the OIG report, claiming there were multiple versions of 
the OIG report but the one that had the incriminating evidence was not the 
one that was publicly released. Will Sommer, “QAnon, the Crazy Pro-Trump 
Conspiracy, Melts Down Over OIG Report,” Daily Beast, June 19, 2018. 
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After a 90-minute standoff with police, Wright drove away, re- 
fusing to stop for law enforcement until he drove over tire strips 
and came to a stop.” Upon arrest, law enforcement found in his 
vehicle two assault-style rifles and two handguns, 900 rounds of 
ammunition, and a flashbang device.** 

Following his arrest, Wright wrote letters to senior government 
officials and politicians, as well as a letter to President Trump.*? In 
the letter to the president, Wright used the term the “Great Awak- 
ening’—QAnon language that refers to the reckoning Trump is 
thought to bring to what they see as the “Cabal” that has infiltrat- 
ed the U.S. government.*° In these letters, Wright used the QAnon 
phrase, “For Where We Go One, We Go All." 

Wright was charged with obstruction of a highway, endanger- 
ment, unlawful flight from law enforcement, misconduct involving 
a weapon, and terrorist acts.*? He later pleaded guilty to making 
a terrorist threat (designated as non dangerous), an aggravated 
assault charge, and fleeing from law enforcement under a plea 
agreement with prosecutors, but the court recently rejected the 
agreement for delivering too lenient of a prison term.*** A future 
hearing date has been set to determine next steps, and Wright ap- 
pears to remain in Mohave County Jail.“ 


Anthony Comello 

While Wright’s actions received some media coverage, Anthony 
Comello’s alleged murder of mafia leader Frank (Francesco) Cali, 
a senior member of the Gambino crime family, garnered massive 
national attention. On March 13, 2019, Comello, a 24-year-old from 
Staten Island, New York, allegedly shot and killed Cali outside his 
family home.*® Comello, who lived with his parents in Staten Island 
at the time, worked periodically in construction.*® 

The month before the incident, Comello entered a federal court- 
house in Manhattan, requesting the arrest of Nancy Pelosi and 
Mayor Bill de Blasio.*” The next day, February 22, 2019, Comello 
was spotted at the Gracie Mansion, the official mayoral residence, 
asking officers to arrest high-profile Democrats, including Max- 
ine Waters, Adam Schiff, and Nancy Pelosi.** On March 13, 2019, 
Comello allegedly drove to Cali’s family home, rang the doorbell, 
and engaged in a conversation with Cali. Comello allegedly then 
pulled out a 9mm pistol and shot Cali several times.*? Comello was 
charged with one count of murder, criminal possession of a weapon, 
and assault.°° 

In his first court appearance on March 18, 2019, Comello wrote 
a large ‘Q’ in pen on his palm alongside several phrases suggest- 
ing support for President Trump, such as “MAGA Forever.” In a 
submission to the court, Comello’s lawyer, Robert Gottlieb, stated 
that Comello did not drive to Cali’s house intending to kill him, 
but to perform a citizen's arrest as he believed Cali was part of a 
purported deep state.” Gottlieb claimed Comello shot Cali after 
he resisted the ‘arrest’* and that Comello believes he is “Trump's 
chosen vigilante.”** 

Following President Trump’s election in 2016, Comello reported- 
ly became more interested in far-right conspiracy theories, and later 
became obsessed with QAnon.®* Gottlieb maintained this QAnon 
obsession led to Comello’s February 2019 quest to perform citizen’s 
arrests.” Gottlieb submitted evidence to the court that Comello was 
posting about far-right conspiracies on his Instagram account, and 


g The indictment of Wright from 2018 remains sealed. 


engaging with QAnon accounts.” According to Gottlieb, Comello 
came across posts that alleged the New York mafia was part of a 
purported deep state alongside the Democrats.** Four days follow- 
ing his arrest, Comello confessed to the NYPD that he believed the 
mafia had been infiltrated by the CIA and that the government was 
spying on him.? On June 3, 2020, Comello was deemed mentally 
unfit to stand trial and was ordered to be transferred to an Office of 
Mental Health facility for examination.° 


Eduardo Moreno 

Just over a year after Comello’s alleged murder of Cali, 44-year- 
old train engineer Eduardo Moreno, allegedly derailed a train in 
San Pedro, California, on March 31, 2020, to draw attention to the 
nearby USNS Mercy naval ship and the government's response to 
COVID-19.* The USNS Mercy was stationed in San Pedro to treat 
COVID-19 patients.® Moreno allegedly derailed the train by re- 
fraining from breaking near the end of the track, causing the train 
to smash through several fences before coming to rest near the 
USNS Mercy.® In post-arrest interviews with the FBI, he claimed 
derailing the train was not preplanned. 

It is unclear whether Moreno was inspired specifically by QA- 
non theories. Court documents note that in post-arrest interviews, 
Moreno stated that “they are segregating us and it needs to be put 
in the open.” The court filing notes that, “Moreno is suspicious 
of the U.S.N.S. Mercy and believes it had an alternative purpose 
related to COVID-19 or a government takeover.’ It has not been 
determined that he was particularly motivated by QAnon-related 
theories. Further, posts by Q before the derailing do not explicitly 
mention the USNS Mercy. 

However, many of Moreno’s comments following his arrest seem 
related to QAnon. Q’s first post about COVID-19 was on March 23, 
one week before Moreno allegedly derailed the train. Q insinuat- 
ed in the post that China developed the virus to harm President 
Trump’s presidency and ensure Joe Biden wins the next election.” 
On March 28, 2020, Q claimed “[t Jhey [the Cabal] want you [the 
American people] divided” by religion, sex, political affiliation, 
and class so “you pose no threat to their control.”** Moreno’s com- 
ments to the LAPP (Los Angeles Port Police) after his arrest that 
“they are segregating us and it needs to be put in the open” perhaps 
were made in this light.®° Moreno also claimed “the whole world is 
watching,” quite similar in phrasing to another Q post on March 
28, 2020, which begins, “the entire world is watching.” Finally, 
according to an LAPP affidavit, Moreno admitted to derailing the 
train to “wake people up,”” similar to Q’s repeated references to 
the “Great Awakening’—a mass realization about the truth of the 
world??—which Q also posted about on March 28, 2020. These 
connections made by the authors, however, are speculative, and 
more information is needed to confirm if Moreno had any rela- 
tionship with QAnon. On April 1, 2020, the Department of Jus- 
tice announced Moreno had been charged with one count of train 
wrecking.” As far as the authors can determine from their tracking 
of court proceedings, he has yet to enter a plea. 


Jessica Prim 

To better explicate the threat QAnon poses to public security, the 
authors now describe, in greater detail, the apparent radicalization 
to violence of Jessica Prim. Prim, a 37-year-old feature dancer from 
Peoria, Illinois, was arrested in New York City on April 29, 2020, af- 
ter allegedly driving onto a pier with a car full of knives.” Prim was 
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charged upon arrest with possession of marijuana and 18 counts of 
criminal possession of a weapon. She also livestreamed this two-day 
trip from Illinois to New York City and in it threatened to kill Joe 
Biden (without making it clear when or where) for his supposed 
involvement in a ‘deep state’ sex trafficking ring, in line with QAnon 
narratives.” 

Prim had allegedly attempted to get close to US Naval ship 
USNS Comfort, a hospital ship sent to New York City for treating 
COVID-19 patients,” as she drove up a service road on Pier 86.” 
However, she had mistaken USS Intrepid, a former aircraft carrier, 
for USNS Comfort.*° QAnon followers thought the USNS Comfort 
was being used to rescue children from the “Cabal.” According to 
her social media posts and video livestreams as she headed to New 
York City, Prim alternated between believing this and that the chil- 
dren may be being held hostage on the ship. 

What stands out with this case is the rapidity with which Prim 
apparently radicalized to violence. From her first contact with QA- 
non propaganda, apparently on April 9, 2020—based on her Face- 
book posts, which the authors reviewed in detail—20 days passed 
until she made threats of offline violence while in transit to New 
York City. 

Prim first started posting about QAnon in a closed Facebook 
group named Pizzagate Investigations Worldwide. On April 9, 
2020, she replied to a post in the group, and on April 14, she shared 
the link to the QAnon “documentary” Out of Shadows to the page. 
Prior to April 9, 2020, there is no evidence Prim was familiar with 
or interacting with QAnon content. Her social media feeds from 
2016 onward do not provide any evidence that she engaged with 
Pizzagate conspiracy content, or the Comet Ping Pong altercation 
in December 2016. The authors’ review of Jessica Prim’s social me- 
dia postings found that she did not post regularly about domestic 
politics or on her social media prior to April 2020.*? 

How did an individual who only recently discovered QAnon ap- 
parently radicalize to violence so fast? Her hours of livestreams, 
which are a rich source of personal information, suggest some pos- 
sible answers. Radicalization is an individual process, and as such, 
some anecdotes Prim recounts in her videos indicate what may have 
made her vulnerable to radicalization to QAnon-related violence. 

Since 2012, Prim has regularly posted content related to miss- 
ing children, child abuse, and arrests of child abusers. This is very 
likely central to her susceptibility to QAnon narratives that feature 
a global sex-trafficking ring. Her social media content and lives- 
treams reflect the significance of this narrative in her conversion 
to QAnon ideology.** 

It is unclear what caused Prim to spiral out of control in the 
20 days preceding her arrest. One element, however, emerges in 
a Facebook video she posted on April 28, 2020, at 12:35pm: her 
relationship with QAnon, she stated in the video, began when one 
of her clients recommended she watch Fall of the Cabal, a QAnon 
documentary by Dutch conspiracy theorist Janet Ossebaard.** In 
this livestream, Prim claims this video motivated her to research 
Pizzagate, and later, QAnon. Prim’s first Facebook post about QA- 
non being on the Pizzagate Investigations Worldwide page is con- 
sistent with this claim. 

Her sharing of the link to the QAnon documentary Out of Shad- 
ows is consistent with this hypothesis, as the documentary also fo- 
cuses on QAnon claims about a global child sex trafficking ring. 
Since she began radicalizing into the QAnon ideology, Prim has 
posted about a wide range of related conspiracy theories regarding 


sex trafficking rings and the supposed Deep State government’s ty- 
rannical attempts to control its population.** 

According to the authors’ review of statements in her livestream 
and Facebook posts, Prim also apparently believes that she is the 
“whore of Babylon” mentioned in the Book of Revelation, and is 
apparently convinced she has a role in bringing about the ‘storm’ 
that Q promises.**" Further, Prim claims she is the coronavirus 
(what this means is unclear) and that President Trump speaks to 
her directly in press conferences and over social media.*” A docu- 
ment Prim apparently posted on her Twitter account reveals she 
was diagnosed with a “brief psychotic disorder” following her arrest 
on April 29, 2020.** 

The authors’ review of Prim’s social media postings and lives- 
treams indicated that she had experienced significant trauma*® 
and appears to have been in crisis at the time of her arrest. In her 
apparent turmoil, it appears Prim latched on to QAnon, especially 
its child sex trafficking ring conspiracy. In the livestream from the 
day of her arrest, she repeatedly claimed that she cannot sit at home 
while children are suffering in her view because of former Vice Pres- 
ident Joe Biden and Hillary Clinton.” It is highly likely that QAnon 
conspiracy theories radicalized her to an apparent desire to commit 
violence, in light of the trauma that made her vulnerable. 

Less than three weeks elapsed between Prim’s first QAnon 
post and her arrest. In this brief period, Prim went from watching 
online child trafficking conspiracy documentaries to offline vio- 
lence-threatening behavior. Prim is a fascinating case study of how 
ideologically motivated violent extremist communities and ideolo- 
gies can radicalize vulnerable individuals. The COVID-19 pandem- 
ic has shown that conspiracy theories and fringe movements are 
especially dangerous in times of social upheaval and could pose a 
public security threat.” 


Conclusion 

In this article, the authors have sought to contextualize QAnon 
ideology and its role in radicalizing several individuals to alleged 
high-profile criminal or violent acts. The recent case of Jessica Prim, 
on which the authors present original data, particularly evinces the 
role the QAnon ecosystem may play in radicalizing uniquely vulner- 
able individuals with experiences of trauma or mental illness and 
the consequent threat QAnon could pose to public security. 

The February 19, 2020, Hanau, Germany, shisha bar attack 
by Tobias Rathjen is a recent example of how conspiracy theories 
could play a role in radicalization to terrorist violence.°? According 
to a study of the attack in this publication by Blyth Crawford and 
Florence Keen, conspiracy narratives “indicate that Rathjen was 
deeply entrenched within online conspiracy communities. Drawing 
upon Barkun’s model of conspiracy belief, it is therefore possible to 
suggest that Rathjen was a supporter of a number of isolated con- 
spiracy theories, which, when compounded, may have influenced 
his broader sense of paranoia and anti-establishment mindset.’®* 
The material consumed by Rathjen could possibly elucidate as- 
pects of his radicalization, as the conspiracy theories espoused by 
Rathjen and other conspiracy theories rely on the rejection of the 


h_ Her social media accounts were operated under a pseudonym, but the 
authors were able to establish that the accounts very likely belonged to her 
because she referred to herself by her real name and broadcast video of 
herself on them. See also Marc-André Argentino, “29/ According to Prim 
God had awakened her to the fact that she is ...,” Twitter, May 1, 2020. 
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mainstream explanation for their own and the demonization of the 
other.** As Crawford and Keen state, “this overlaps with online con- 
spiracy communities suggests that the influence of Rathjen’s attack 
may be felt in spheres beyond those traditionally associated with the 
far right.”’ Rathjen’s deep involvement in online conspiracy theory 
communities and subsequent attack evinces the potential for future 
instances of larger scale violence motivated by QAnon. 

Moreover, QAnon continues to gain traction in American pop- 
ular culture. For example, QAnon followers have recently absurdly 
alleged on social media that Oprah Winfrey, Ellen DeGeneres, and 
other celebrities are under house arrest for their participation in 
child sex trafficking rings. These posts have circulated widely on- 
line, with some celebrities even responding to the allegations.°° 

QAnon is not destined to remain on the periphery of political 
discourse either. CNN reported that former national security advis- 
er Michael Flynn posted a video on July 4, 2020, which showed him 
and a group repeating an oath of office before saying the common 
QAnon phrase, “Where we go one, we go all.” The post also included 
the hashtag #TakeTheOath, apparently referencing a social media 
trend by QAnon users from earlier in the week.” Flynn’s lawyer 
Sidney Powell told The Washington Examiner, “The slogan comes 
from an engraved bell on JFK’S sailboat—acknowledging the unity 
of mankind. The oath is obvious—the federal oath in support of our 
Constitution. He wanted to encourage people to think about being 
a citizen. Don’t read anything else into it.” 

Further, as reported by Alex Kaplan at Media Matters as well 
as in The New York Times,9® more than 60 candidates who have 
run for Congress in 2020 appear to have expressed some degree of 
support for QAnon (mostly Republicans and Independents; two 
of the 66 were Democrats), and Marjorie Taylor Greene,' a QAnon 
follower running for a Georgia seat in the House of Representatives, 
is favored to win the Republican nomination as well as the general 
election.1°° Jo Rae Perkins, a QAnon follower, recently won the Re- 


i According to reporting from Media Matters in 2018, Greene posted on 
Facebook about an “awesome post by Q.” See “Marjorie Taylor Greene 
Facebook QAnon2,” Media Matters. She has posted the QAnon slogan 
on Facebook (see “Marjorie Taylor Greene Facebook QAnon 1,” Media 
Matters) and on Twitter (see “Marjorie Taylor Greene Twitter QAnon 2,” 
Media Matters), the latter in response to a tweet defending the legitimacy 
of “Q” where she also wrote, “Trust the plan” (another catchphrase QAnon 
supporters use). Greene also has tweeted the QAnon-connected hashtag 
“#GreatAwakening’” to far-right conspiracy theorist Alex Jones. She has 
also appeared in a video where she discussed following QAnon, calling “Q” a 
“patriot” and “worth listening to.” See Travis View, “Marjorie Taylor Greene, 
candidate for congress, also happens to be a QAnon follower,” Twitter, 
June 6, 2020. According to The Atlanta Journal-Constitution, Greene “has 
posted a series of tweets defending QAnon, including one” —now deleted— 
"encouraging her followers to message her with questions so she can ‘walk 
you through the whole thing.” Jim Galloway, Greg Bluestein, and Tamar 
Hallerman, “The Jolt: When industry and neighborhoods mix, trouble often 
follows,” Atlanta Journal-Constitution, August 2, 2019. 


j According to reporting from Media Matters, “Perkins has repeatedly 
tweeted in support of QAnon and posted the QAnon slogan on Twitter, and 
both her personal and campaign Facebook pages. See Jo Rae Perkins, “The 
MG Show -236- 5/1/20 ‘Information warfare’ Imagine that ...;” Twitter, May 
4, 2020, and Jo Rae Perkins, “Congratulations to @laurenboebert We need 
more #Patriots like Lauren ...,” Twitter, July 2, 2020. Perkins has also said 
she follows the “Q team.” See “Jo Rae Perkins January 2 Facebook video,” 
Media Matters. See also Alex Kaplan, “Here are the QAnon supporters 
running for Congress in 2020,” Media Matters for America, updated July 23, 
2020. 


publican nomination for U.S. Senate in Oregon, though she appears 
likely to lose in the general election.’ 

Already, then, QAnon supporters are trying to have an increased 
impact on mainstream discourse in the United States. With this 
mainstreaming, as well as the impending presidential election that 
seems likely to only increase QAnon’s salience, an increasing fre- 
quency of criminal or violent acts by QAnon supporters seems pos- 
sible, even likely.'°? While the aforementioned criminal acts seem 
largely motivated by QAnon, only Matthew Philip Wright has been 
charged with a terrorism offense. However, the 2020 Hanau shisha 
bar attack presents one example of how conspiracy theories can 
help propel larger-scale terrorist attacks.’ If more individuals with 
greater organizational skills and operational acumen seek to pursue 
QAnon’s agenda, it could eventually lead to more significant threats 
to public security and become a more impactful domestic terrorism 
threat, though this potential development appears, at present, to be 
far on the horizon. 

However, the threat to public security that QAnon presents is 
not exclusive to the movement and the cases described above, but 
rather, is representative of broader currents in the American infor- 
mation landscape. The increased consumption and circulation of 
misinformation on social media, as well as its negative consequenc- 
es, is evinced especially by QAnon, but its effects on public safety 
are not limited to it. The emergence of future (related or unrelated) 
conspiracy theories that may be effective at radicalizing individuals 
to terrorist violence should thus not be ruled out as threats to public 
security. 

Regulation of QAnon content by social media companies, activi- 
ty which would be guided and governed by the adherence of QAnon 
supporters to respective platforms terms of service, may present one 
pathway to decreasing the likelihood of individual radicalization to 
violence.’ This could operate similarly to Facebook and Twitter 
regulation of jihadi content by the Islamic State and al-Qa ‘ida af- 
filiates. On July 21, 2020, Twitter announced” that it will be tak- 
ing action against QAnon in light of “coordinated harmful activity.” 
Already Twitter has suspended 7,000 accounts and will be limiting 
150,000 more.!° 

However, regulation of QAnon content could simply result in 
platform migration and further reinforce QAnon’s cosmology that 
sees a cabal of pedophiles lurking behind every corporate or gov- 
ernmental decision.'©’ This is to be considered carefully, based on 
the authors’ observation of QAnon activity on Telegram, there is 
a growing overlap between QAnon channels and more extremist 
channels affiliated with the proud boys,’ paramilitary groups, and 
white supremacists.'°? Additionally, the law enforcement commu- 
nity and researchers need to consider the growing transnational 
dimensions of QAnon.”° QAnon is arguably no longer simply a 
fringe conspiracy theory but an ideology” that has demonstrat- 
ed its capacity to radicalize to violence individuals at an alarming 
speed. CTC 
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